The 4th International Conference on Applied Automation and Industrial Diagnostics (ICAAID), 29-31 March 2022, Ha’il, KSA

Towards the Integration of Security and Safety

Systems
Ashraf Armoush
Computer Engineering Department
An-Najah National University
Nablus, Palestine
[email protected]

Abstract—The design of safety-critical embedded systems is a of safety, high reliability, availability, and low cost. However,
complex process that involves the reuse of proven solutions to the security aspects of these systems are rarely addressed or
fulfill a set of requirements. While safety is considered as the often misconstrued at the late phases of development [19].
major requirement to be satisfied in safety-critical embedded
systems, the security attacks can affect the security as well as With growing number of safety-critical applications, it has
the safety of these systems. Therefore, ensuring the security of
become clear that the safety-critical embedded systems need to
the safety-critical embedded systems is as important as ensuring
the safety requirements. The concept of design patterns, which access, store, and communicate sensitive information. While
provides common solutions to widely recurring design problems, the security attacks against general information systems repre-
have been extensively engaged in the design of the hardware and sent a large and growing problem, the attacks against safety-
software in many fields, including embedded systems. However, critical systems are much more severe and can have catas-
there is an inadequacy of experience with security patterns in the
trophic effects. Therefore, ensuring the security of the safety-
field of safety-critical embedded systems. To address this problem,
this paper proposes an approach to integrate security patterns critical embedded systems is as important as ensuring the
with safety patterns in the design of safety-critical embedded safety requirements, and both should be treated concurrently at
systems. Moreover, it presents a customized representation for early phases of system development life-cycle. Unfortunately,
security patterns to be more relevant to the common safety the designers and developers in the safety-critical domain are
patterns in the context of safety-critical embedded systems.
lacking the experience of handling security concerns in the
Index Terms—Security Pattern, Safety Pattern, Safety-Critical,
Embedded Systems design of these systems. They should be assisted by security
guidelines and a set of proven security solutions in order to
I. I NTRODUCTION alleviate this lack of security expertise.

Over the last few years, embedded systems have been The concept of design patterns, which is a universal ap-
widely used in many domains, including safety-critical domain proach to describe common solutions to commonly recurring
where failures could lead to serious consequences, such as design problems, has been widely used in many domains.
endangering human life, substantial economic loss, or exten- It aims to assist designers choose appropriate solution for
sive environmental damage [11]. The complexity of safety- recurring design problems. Therefore, this concept might also
critical embedded systems introduces the need for merging be applicable to address the growing concerns of the security
well-known and proven design techniques and strategies to in safety-critical embedded systems.
fulfill the strict specifications for these systems. In this paper, an approach has been proposed to integrate
The designers of safety-critical systems should address the security patterns with the safety patterns in the design pro-
the functional requirements which cover the functions to cess of safety-critical embedded systems. A modified pattern
be performed. Meanwhile, they have to consider the Non- representation has been introduced to facilitate the selection
Functional Requirements (NFRs) in the design process. The of a suitable security pattern and the integration with safety
non-functional requirements, which include the quality factors patterns. The rest of this paper is structured as follows: Section
of a system as it conducts its job [20], are very important and II provides a review of the most important related work.
have become more and more difficult to achieve in the field of Section III presents the modified template representation for
safety-critical embedded systems. For long time, practitioners security patterns. Section IV presents the proposed approach
in the safety-critical field have closely considered a list of and section V illustrates it with an example for safety and
common non-functional requirements, such as adequate level security patterns. Finally, section VI concludes the proposed
approach and outlines possible issues for future work.
978-1-7281-8939-0/22/$31.00 ©2022 IEEE

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.
 II. R ELATED W ORK Goal Structuring Notation diagram and a catalogue of security-
enhanced safety patterns was presented.
Like all patterns, security patterns, which provide assured Amorim et al. [1], [14] concentrated on the selection and
security solutions to solve similar security problems, have been combination of safety and security patterns in context of sys-
widely examined on different levels and in many domains tem engineering. They proposed a pattern-based engineering
during the last decade. E.g. a list of general security patterns life cycle process that provided a systematic approach to
were presented in [7] to help application developers who interlink safety and security related patterns in the automotive
are not security experts to add security in their applications. domain. This research can be considered as the most related
Moreover, different approaches and methodologies have been work to our approach since it covers the safety and security
proposed to integrate security patterns during all phases of pattern in automotive domain which is a specific field of
design process. Starting from user requirements, the security safety-critical applications. In the same field, Cheng et al. [5]
requirements should be translated in system security require- discussed the security pattern concept in relation to automotive
ment [8]. Consequently, the security patterns should be systems and introduced a set of security design patterns
integrated with all stages of the design life cycle. Bouaziz et targeted for automotive security needs.
al. [4] proposed a security pattern integration approach from
the earliest phase until the generation of the software code. III. PATTERN T EMPLATE
The proposed solution used the UML component model as an
application domain of security patterns. Design Patterns, which give abstract solutions to commonly
recurring design problems, have been commonly used in the
Motii et al. [15]–[17] combined the risk management and
software field after the success of the book by the Gang of Four
security pattern-based system and system engineering together
(GoF) [9]. Ever since, this concept has been adapted in several
to guide the picking of security patterns and to provide a
domains to address many design requirements. In previous
pattern classification. A model-based approach for integrating
work, we have addressed the concept of design pattern to
security pattern was proposed to provide a proper solution for
represent the safety requirements for safety-critical embed-
component-based software architecture using UML. Similarly,
ded systems [2]. Moreover we have presented a modified
Ruiz et al. [21] presented an engineering process to integrate
pattern representation by including fields for the side effects
security engineering into the regular UML-based system en-
and implications of the represented design pattern on safety,
gineering process for the development of security-sensitive
reliability, modifiability, cost, and execution time [3]. Un-
systems.
fortunately, the security patterns and the possible integration
The growing number of existing security patterns con-
between safety and security patterns were not studied.
founded users in finding the most appropriate solution for
Recently, many security patterns have been proposed with
a given design security problem. Weiss et al. [24] presented
many pattern representations and templates [12], [13], [22],
a selection method for security patterns in terms of global
[25]. Nevertheless, we need a modified representation for se-
requirement language. Prolog rules were used to reason about
curity patterns in the field of safety-critical embedded systems
the evaluation mechanism and show the effect of combining
to support the integration with available safety patterns.
different security patterns.
While all pattern templates include three main parts (con-
Occasionally, the designers feel necessity for a catalogue
text, problem and solution), they differ in many other parts.
or a repository of security patterns to simplify the selection
In this paper, the proposed pattern template includes the
process. Hamid et la. [10] proposed a framework to associate
following parts:
the model-driven paradigm and a model-based repository of
• <Pattern Name>: A common name (Simple Phrase) to
security and dependability patterns to assist the development
of trusted Resource Constrained Embedded System (RCES) describe and identify the pattern uniquely, and it will be
applications for different domains. On other hand, the avail- used to designate this pattern in the design process.
• <Other Names>: The other well-known names for the
ability of a development tool, which can be used to address
the complexity and ease the design of secure systems, is given pattern, if exist.
• <Security Service>: The classification of the security
productive [23].
Most of the aforementioned researches addressed the se- pattern based on the general security service provided by
curity issue separately from the other non-functions require- this pattern to ensure adequate security of the system. We
ments, especial the safety requirement, in the design of em- follow the X.800 OSI Security Architecture which classi-
bedded systems. The state-of-the art provides some attempts, fies the security service into the following categories:
either to modify the safety pattern to cover some security – Authentication
consideration, or to integrate the selection of safety patterns – Access Control
with the selection of security patterns in specific domain of – Data Confidentiality
applications. Preschern et al. [18] extended existing architec- – Data Integrity
tural safety patterns to address security aspects. A STRIDE – Non-Repudiation
approach on the safety patterns to obtain relevant threats for • <Abstract>: This field presents a brief description of the
each pattern was proposed. The threats were structured in a pattern

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.
 • <Context>: The common situation (domain assump-
tions) where the designer may use this pattern.
• <Problem:> This part gives a summary of the design
problem which is considered and solved by this pattern
(The security goal to be achieved)
• <Pattern Structure:> This is the main part of the
pattern, since it presents a solution to the problem under
consideration. It describes the main parts of the pattern,
the relation between these parts, and how they cooperate
to give a solution to the addressed problem.
• <Consequences and Side effects>: The implications that
can be achieved by this pattern, in addition to the side
effects, constraints, and drawbacks that crop up when the
pattern is applied.
• <Implementation>: The main points, advices, tech-
niques that should be considered during the implementa-
tion of the pattern.
• <Interface to Safety Pattern>: This part presents a well-
defined interface to disseminate the status of the security
Fig. 1. An overview of the integration process
pattern to the safety design pattern, which is responsible
for controlling the safety-critical embedded system.
• <Related Patterns>: The associated security patterns. template and then grouped according to the addressed security
And the potential to incorporate them with this one. service.
IV. I NTEGRATION OF S AFETY AND S ECURITY PATTERNS : After the completion of the three phases, two catalogues
of patterns will be constructed, one for safety patterns and
The idea behind the concept of design patterns is to support the other for security patterns. The classification of the safety
and guide designers in solving a common design problem and security patterns, as described previously, will assist the
which occurs over and over in many applications. Each pattern designer in selecting the most appropriate safety pattern that
covers a specific problem in a specific context and provides a fulfills the safety requirements, then in selecting the security
proven solution to this problem. Several safety design patterns pattern that best fit to the selected safety pattern. This process
have been collected as catalogues to improve designers ability could be conducted manually, or an automated tool will be
to select appropriate patterns for safety-critical systems. On the considered for future work.
other hand, several security patterns have been presented in the
literature to deal with security problems in general computing V. C ASE S TUDY
systems. In the proposed approach, we aim to integrate the
general security design patterns with safety patterns to provide In order to illustrate the proposed approach, the first two
a guidance in the selection of a suitable combination of safety phases are considered in the following example safety pattern.
and security patterns. The Monitor-Actuator Pattern [6] is a safety pattern that
Our approach consist of three phases as shown in Figure 1: is applicable for safety-critical systems with low-level of
In the first phase, the available safety patterns should be availability requirement and existing fail-safe state which, in
assessed in order to identify the threats and vulnerability of the case of failure, can be considered as being safe without
the patterns. This security assessment will clarify the possible risk. In many design methods, a safety procedure should be
security attacks and summarize the main security requirements conducted, in the case of failure, to reach predefined safe state.
for the available safety patterns. In the second phase, refined As shown in figure 2, the pattern consists of two channels,
versions of the safety patterns should be constructed based on main actuation and monitoring channel, that run independently
the outcome of the first phase. The modified safety patterns on heterogeneous platforms, including microcontrollers or
will include the necessary missed parts to deal with the identi- FPGAs. The main actuation channel collects the input data
fied security requirements of the original patterns. To facilitate from input sensors and provides a check on the measured
the future integration with the security patterns, the security values and the system itself to ensure the correct conducting
requirements for the safety patterns should be classified into of the required operations. The monitoring channel is used
five categories similar to the security service field presented in to track the safety of the system by performing a continuous
the proposed security pattern template. Moreover, the safety monitoring for the actuation channel. It collects the data from
patterns should also indicate the suitable safety action to be the set point source and the actuator sensors and compares
performed based on the possible disseminated outcome from it with the given set points to identify possible faults in the
the security patterns. In the last phase, all the security patterns main channel. In the case of incorrect operation, it imposes
should be represented using the proposed security pattern the main channel to enter the fail-safe state.

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.
 Fig. 2. The Monitor-Actuator Pattern

Based on the first phase of the proposed approach, a security • Other Names: Message Authentication Pattern.
assessment and risk analysis, for the pattern under consider- • Security Service: Data Integrity Protection.
ation, were conducted. Only the security threats, that might • Abstract: This pattern provides a solution to the data
affect the safe operation of safety-critical embedded system, integrity problem by using a message authentication code
will be covered during this phase. As it was mentioned earlier, which is a code that can be calculated only by the sender
the patterns consists of two independent and heterogeneous or the intended recipient of the message.
hardware channels that run in parallel to carry out the intended • Context: Two entities exchange sensitive information
functional requirements and to ensure the safe and reliable through messages using insecure communication chan-
operation of the embedded system. As a result of the security nel (Insecure Network). In such network, attackers may
and risk assessment for this pattern, the main threat comes intercept messages and try to modify or replay them.
from the possible external attempts to modify the exchanged • Problem: How to establish a secure channel for the com-
messages between the two channels or to replay old messages, municating entities so that they can exchange messages
which in turn affects the safe operation of the embedded in an authenticated manner. The messages’ data integrity
system. Accordingly, the main security threat in this pattern as well as their authenticity must be guaranteed in both
can be classified as a weakness in the integrity as a security directions.
service. • Pattern Structure: The solution to the integrity problem
In the second phase of the proposed approach, the presented depends on the concept of message authentication code
pattern should be modified to introduce a refined version (MAC), a code which is generated using a cryptographic
to cope with the elaborated security threats from the first algorithm and a shared secret information (key) between
phase. Therefore, figure 3 shows a refined version of the the sender and the recipient. The main parts of this
previous pattern, where a new component is added to protect pattern is shown in the figure 4. The sender uses the
the communicated messages between the two channels. The message to be protected and the shared key as input to the
new component should implement one or more safety patterns algorithm to generate the authentication code. The MAC
to provide an integrity protection against the previously men- is appended to the message and then sent to recipient
tioned threats. via insecure channel. The recipient performs a similar
Consequently, the security patterns, which are classified as computation on the received message and the secret key
integrity-protection patterns, are applicable to be integrated to generate a MAC, then a check with received MAC
with this safety pattern to deal with two specific problems: is conducted. The matching between the computed and
message authentication and replaying problems. received codes provides an evidence that the message is
To illustrate the third phase of the proposed approach, we unaltered and comes from the corresponding sender.
have selected the Data Origin Authentication Pattern, which is • Consequences and Side effects: The pattern does not pro-
one of the security patterns that can solve the aforementioned vide a protection against a recorded message with valid
security problem. The selected security pattern is represented MAC. Therefore, other technique should be integrated
using the proposed template as follows: with this pattern to protect against the replayed messages.
On other hand, the time overhead for computing the code
• Pattern Name: Data Origin Authentication Pattern.

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.
 Fig. 3. The Refined Monitor-Actuator Pattern

Fig. 4. Data Origin Authentication (Message Authentication) Pattern

for each message should be considered in choosing a fast ment and key transferring, have been presented in
algorithm especially for strict real-time applications. the literature. Nevertheless, a pre-shared static key is
• Implementation: more suitable for embedded systems with hardware
– The main part for this pattern is the transfer algo- implementation.
rithm which can be implemented using two tech- • Interface to Safety Pattern: The effect of this pattern on
niques: the safety patterns depends on the result of comparison
∗ Hash based Message Authentication Code between the received and the computed MAC, which can
(HMAC): using a keyed hash function like SHA2 be one of the following:
or SHA3. – Valid new MAC: This case indicates a normal
∗ Cipher based Message Authentication Code operation and no security violation.
(CMAC): using a block cipher algorithm like – Invalid MAC: This case indicates an attempt to
3DES or AES. attack the security of the communication channel,
– A time stamp can be embedded into the message be- which in turn affects the safety of the embedded
fore computing the MAC to protect against recorded system. Thus, a safety action, which depends on the
old messages. safety pattern, should be conducted to force the main
– Providing a shared secret key, between the sender actuation channel reaching its fail-safe state.
and the recipient, is considered as a problem in this • Related Patterns: Digital Signature Pattern and IPSEC
pattern. Therefore, many technique, for key agree- VPN pattern.

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.
 VI. C ONCLUSION AND F UTURE W ORK : [9] E. Gamma, R. Helm, R. Johnson, and J. Vlissides. Design patterns:
elements of reusable object-oriented software. Pearson Deutschland
In this paper, an approach has been presented to integrate GmbH, 1995.
security patterns with safety patterns in the development of [10] B. Hamid, J. Geisel, A. Ziani, J.-M. Bruel, and J. Perez. “Model-
safety-critical embedded systems to overcome the lack of driven engineering for trusted embedded systems based on security
and dependability patterns.” In International SDL Forum, pp. 72-90.
experience with security solutions for common problems in the Springer, Berlin, Heidelberg, 2013.
earlier stages of system design. Moreover, a security pattern [11] J. C. Knight. “Safety critical systems: challenges and directions.” In Pro-
representation has been proposed to facilitate the selection ceedings of the 24th international conference on software engineering.,
pp. 547-550. IEEE, 2002.
process of the suitable security pattern. The representation [12] P. Mahendra and A. Ghazarian. “Patterns in the requirements engineer-
provides a classification for the security design patterns ac- ing: A survey and analysis study”. WSEAS Transaction on Information
cording to the security services, and a well-defined interface Science and Application, vol. 11, pp. 214-230, 2014.
[13] A. Maña, E. Damiani, S. Guergens, and G. Spanoudakis. “Extensions to
to disseminate the status of the security pattern to the safety pattern formats for cyber physical systems.” In Proceedings of the 21st
design pattern. A sample security pattern was represented Conference on Pattern Languages of Programs, pp. 1-8. 2014.
using the proposed template to be integrated with a given [14] H. Martin, Z. Ma, C. Schmittner, B.Winkler, M. Krammer, D. Schneider,
T. Amorim, G. Macher, and C. Kreiner. “Combined automotive safety
safety pattern in order to explain our proposed approach. and security pattern engineering approach.” Reliability Engineering &
In the future, a catalogue of common and appropriate System Safety, vol. 198, p. 106773, 2020.
security patterns will be constructed to be used with the [15] A. Motii, B. Hamid, A. Lanusse, and J.-M. Bruel. “Guiding the selection
of security patterns based on security requirements and pattern classi-
available catalogue of safety patterns. Furthermore, a tool fication.” In Proceedings of the 20th European Conference on Pattern
will be developed to facilitate the automated selection and Languages of Programs, pp. 1-17. ACM, 2015.
combination of consistent security and safety patterns to [16] A. Motii, B. Hamid, A. Lanusse, and J.-M. Bruel. “Guiding the selection
of security patterns for real-time systems.” In 2016 21st International
maintain the security and safety requirements in context of Conference on Engineering of Complex Computer Systems (ICECCS),
safety-critical embedded systems. pp. 155-164. IEEE, 2016.
[17] A. Motii, B. Hamid, A. Lanusse, and J.-M. Bruel. “Towards the
R EFERENCES integration of security patterns in uml component-based applications.”
In PAME/VOLT@ MODELS, pp. 2-6. 2016.
[1] T. Amorim, H. Martin, Z. Ma, C. Schmittner, D. Schneider, G. Macher, [18] C. Preschern, N. Kajtazovic, and C. Kreiner. “Security analysis of safety
B. Winkler, M. Krammer, and C. Kreiner. “Systematic pattern approach patterns.” In Proceedings of the 20th Conference on Pattern Languages
for safety and security co-engineering in the automotive domain”. In of Programs, pp. 1-38. 2013.
International Conference on Computer Safety, Reliability, and Security, [19] S. Ravi, A. Raghunathan, P. Kocher, and S. Hattangady. “Security in em-
pp. 329–342. Springer, 2017. bedded systems: Design challenges.” ACM Transactions on Embedded
[2] A. Armoush. Design patterns for safety-critical embedded systems. PhD Computing Systems (TECS), vol. 3, no. 3, pp. 461-491. 2004.
thesis, RWTH Aachen University, 2010. [20] S. Robertson and J. Robertson. Mastering the requirements process:
[3] A. Armoush, F. Salewski, and S. Kowalewski. “Design pattern repre- Getting requirements right. Addison-wesley, 2012.
sentation for safety-critical embedded systems”. Journal of Software [21] J. F. Ruiz, A. Maña, and C. Rudolph. “An integrated security and systems
Engineering and Applications, vol. 2, no. 1, p. 1, 2009. engineering process and modelling framework.” The Computer Journal,
[4] R. Bouaziz, S. Kallel, and B. Coulette. “An approach for security vol. 58, no. 10, pp. 2328-2350. 2015.
patterns application in component based models”. In International Con- [22] R. Slavin, J.-M. Lehker, J. Niu, and T. D. Breaux. “Managing security
ference on Computational Science and Its Applications, pp. 283–296. requirements patterns using feature diagram hierarchies.” In 2014 IEEE
Springer, 2014. 22nd International Requirements Engineering Conference (RE), pp. 193-
[5] B. H. Cheng, B. Doherty, N. Polanco, and M. Pasco. “Security patterns 202. IEEE, 2014.
for automotive systems.” In 2019 ACM/IEEE 22nd International Confer- [23] M. Vasilevskaya, L. A. Gunawan, S. Nadjm-Tehrani, and P. Herrmann.
ence on Model Driven Engineering Languages and Systems Companion “Integrating security mechanisms into embedded systems by domain-
(MODELS-C), pp. 54-63. IEEE, 2019. specific modelling.” Security and Communication Networks, vol. 7, no.
[6] B. P. Douglass. Real-time design patterns: robust scalable architecture 12, pp. 2815-2832. 2014.
for real-time systems. Addison-Wesley Professional, 2003. [24] M. Weiss and H. Mouratidis. “Selecting security patterns that fulfill
[7] E. Fernandez-Buglioni. Security patterns in practice: designing secure security requirements.” In 2008 16th IEEE International Requirements
architectures using software patterns. John Wiley & Sons, 2013. Engineering Conference, pp. 169-172. IEEE, 2008.
[8] A. Ferrante, I. Kaitovic, and J. Milosevic. “Modeling Requirements for [25] N. Yoshioka, H. Washizaki, and K. Maruyama. “A survey on security
Security-enhanced Design of Embedded Systems.” In SECRYPT, pp. patterns.” Progress in informatics, vol. 5, no. 5, pp. 35-47. 2008.
315-320. 2014.

Authorized licensed use limited to: BMS College of Engineering. Downloaded on February 17,2025 at 04:17:07 UTC from IEEE Xplore. Restrictions apply.