UML-SR: A Novel Security Requirements Specification Language

Existing security specification languages are not fully equipped to express low-level security requirements and design decisions such as input validation (a security requirement for a number of highly severe vulnerabilities). This inability of current specification languages compels developers to make security-related decisions on their own. We propose, a new security specification language named UML-SR using the extension mechanism of UML. UML-SR is based upon security requirements that need to be used to avoid the some of the most severe vulnerabilities according to the Common Vulnerability Scoring System of the National Vulnerability Database. UML-SR enhances UML use case, activity, class, and sequence diagrams with security requirements such as input validation, multi-factor authentication, closing port after an interval of inactivity, checking privileges, allowing only whitelisted commands, checking parameters passed when calling a function, session expiration check on the server side, and password aging. In this paper, we use stereotypes, constraints, and tags to represent these security requirements as a case study.