Implementing the Decorator Pattern in Java

At the Institute for Cyber Security, our software architects help fulfill the role of CTOs for new security startups, and will work with development teams to come up with technical solutions to existing development problems. In one recent example, one developer had to modify the behavior of an existing code base but could not modify the code due to licensing.

Normally, the solution is to subclass the original class, then add your behavior as necessary. However, in this case, the class was finalized, meaning the class could not be inherited. This stumped our intrepid developer--surely someone must have solved this problem before!

In software engineering, a design pattern is a general reusable solution to a commonly occurring software design problem. As you may have surmised from the title of this post, our architect recognized the issue and recommended the decorator pattern. This allows new behavior to be added to an existing class dynamically (assuming some design work had been done in advance) as an alternative to subclassing.

The decorator pattern is achieved by designing a new decorator class that wraps the original class. This wrapping could be achieved by the following sequence of steps:

1. Create an interface and the base "component" class that implement it.
2. Implement the interface into a "decorator" class.
3. In the Decorator class, add a Component "pointer" as a field;
4. Pass a Component to the Decorator constructor to initialize the Decorator's Component;
5. In the Decorator class, redirect all "Component" methods to the internal Component pointer and override any Component method(s) whose behavior needs to be modified.

This pattern is designed so that multiple decorators can be "stacked" on top of each other, each time adding a new functionality to the overridden method(s).

The above listing is best demonstrated by example.Consider the following: we have a Car class which has some functionality we'd like to modify, say by adding a top to the car or an engine. Listing 1 shows a Car interface and SimpleCar class.

Listing 1: Car Interface and SimpleCar Class

To add a top or an engine, we'd need separate classes for each functionality, and an abstract class that they extend (see Listing 2):

Listing 2: CarDecorator, TopDecorator, and EngineDecorator Classes

Using Listing 3, we can view the results of the Decorator pattern by calling the GetInfo method, which should return "car, with top, with revved engine".

Listing 3: DecoratedTest Class

In some dynamic languages, this can be more easily achieved, but in Java, this seals the deal and our developer was able to walk away, not only with a solution to his specific problem, but with a broader understanding of design patterns in general.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

The Mobile Botnet--It was Only a Matter of Time

The recent Symbian smartphone worm likely represents one of the world's first mobile large-scale botnet attacks. As with most botnet attacks, the app is cloaked as a genuine Symbian phone application but instead delivers a payload that gathers device user information and transmits that data out to the host. Additionally, the attack spreads by forwarding itself to contacts loaded into the memory of infected devices.  The latest version, dubbed SymbOS.Exy.C. by Symantec, has the most "botnet-esque" behavior patterns yet seen in a mobile attack campaign.

As covered previously, a botnet is better described as a "zombie network, where each computer hosts a small program (the eponymous bot) that runs in the background that performs tasks on behalf of the attacker. Since cell phones are as powerful as desktop computers from the earlier part of this decade, it's not too surprising that we should see mobile botnets--it was only a matter of time. The only obstacle was a shared platform. One reason why machines running Microsoft Windows  are frequent targets for such virus and botnet attacks is that the Windows OS is the dominant operating system on the market, with over nine out of ten machines running the system. At a high-level, it is safe to say that code written for one OS will likely not run on another.

Symbian, however, dominates the cell phone market share, with about the same marketshare as all other cell phone manufacturers together, Like Microsoft Windows, Symbian (or their users) has become a victim of their own success. It is also very possible that we will see other mobile botnet attacks on this or other platforms in the future.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

The U.S. Cyber Challenge

A national "talent search" for high school and college students interested in working in cybersecurity was launched today. The so-called U.S. Cyber Challenge's goal is to find 10,000 young Americans to be "cyber guardians and cyber warriors", and is being sponsored by the Center for Strategic & International Studies, is also being led in conjunction with the SANS Institute, the U.S. Department of Defense (DoD), and several university and private-industry partners.

With a name reminiscent of DARPA's famous Grand Challenge and Urban Challenge, the US Cyber Challenge is more of a series of ongoing contests, rather than one defined competition. The cyber challenge will provide participants with competition, training, recognition and a chance to win scholarships. The three ongoing competitions are:

• The CyberPatriot Defense Competition: a high school cyber defense competition run by the Air Force Association
• The DC3 Digital Forensics Competition: a DoD competition that focuses on cyber investigation and forensics. The DoD is offering a one million dollar prize to people who find solutions to digital forensics problems that currently can’t be solved.
• NetWars Capture the Flag Competition: a SANS Institute challenge, played across a network on a custom OS, with the aim of penetrating the opponent’s net security and controlling key files on a server.

Interesting stuff! More information on the competition can be found on the CSIS site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS on KSAT 12 News

KSAT 12 News ran a wonderful segment yesterday on the Institute for Cyber Security. The story discussed the Institute for Cyber Security at length, with our executive director Ravi Sandhu interviewed. Both the article and the video are online.

"A small act can lead to huge results in cyber space," said Dr. Sandhu. "Your attacker always has this advantage. A small attack can be amplified." The article also covers the new Air Force Cyber Command located in Lackland Air Force Base and how both missions intersect.

Look for more good news coming from ICS soon!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Aspect-Oriented Programming and AspectJ

At the Institute for Cyber Security, we use many different technologies to help accomplish our goals at ICS Labs and the Incubator. One such technology is Aspect-Oriented Programming (AOP), a programming paradigm allowing the separation of cross-cutting concerns from core concerns. Although many software frameworks such as Spring allow for limited aspect-oriented development, I've always been fond of the AspectJ language as it provides a better pedagogy for aspects and how they differ from objects.

Object-oriented programming (OOP) guides developers into exploiting the expressive power of the object model and uses classes as their fundamental building blocks. Generally, classes may be too specialized for general “drop” reuse, are "tangled" (implementing many requirements of a system), or are used in many places ("scattered" in many classes), such as security or session expiration mechanisms.

Because scattering and tangling defy the OOP paradigm, they are symptoms of “crosscutting concerns”, as they cut across many modules in a program. AOP is an attempt to corral these naturally, with aspects being well-modularized crosscutting concerns. Gregor Kiczales and his team at Xerox PARC originated the concept of AOP and its most popular general purpose language, AspectJ. AspectJ is the most well-known and is a superset of Java (i.e., all AspectJ programs compile to Java bytecode).

In AOP, points in the code where we would want to run our code (instead of writing it in the class itself) are called "join points". A join point can be almost any line of code—a method or constructor call, a field get or set, object initialization, or exception handler execution. AspectJ intercepts program execution flow at these join points and runs the code we want to run instead, called advice, which can happen before, after, or instead of the join point. An aspect describes these join points as pointcuts, which can describe one or more join points.

An example Java program using a simple logging mechanism is shown below. In MainClass.java, two methods are being called, and with code from Logger.java being executed when each method (save the main method) is entered and left.

MainClass class (left) and Logger aspect (right)

In the AspectJ program below, any reference to logging in MainClass.java is removed. In place of the Logger class, the Logger aspect encapsulates the logging concern. It has one pointcut called SayAnything that describes all join points that are methods being called (using the call keyword) that starts with “say” and has any number of parameters. Two advice are associated with the pointcut. The before advice gets the signature of the join point it is in, and prints “Entering” with the signature’s name. The after advice does the same, printing “Leaving” with the signature's name instead. Thus, whenever any of these join point is reached in the execution of the program, it calls the code in the before advice, executes as normal until the end of the join point, and calls the after advice.

MainClass class (left) and Logger aspect (right)

At compile time, the compiler "weaves" the code from an aspect’s advice into the join points their pointcuts describe, leaving .class files that any Java runtime may execute. Because aspects are a superset of classes, they can contain members and methods, and can even extend other aspects or classes, although classes cannot extend aspects. Also, aspects can be quite powerful, able to read and process code with around advice, affecting the execution of the program at runtime in dynamic and very interesting ways. By the same token, AOP and AspectJ's power lend itself to augment code outside its boundaries, possibly leading to software contract-breaking. Like in any paradigm, a little knowledge is a dangerous thing (but a little more knowledge can do wonders).

For more on AOP and AspectJ, the seminal paper on AOP is a great start. There is also a classic series of tutorials on AOP by Ramnivas Laddad online.

Picture at the top shows the difference between core and corss-cutting concerns, pulled from an older version of Apache Tomcat. Red shows the relevant lines of code. The XML parsing capability of the project is well-modularized in one file, whereas the project's logger is used in a large number of places.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Ravi Sandhu Presenting on Access Control in Lyon, France

Dr. Ravi Sandhu, Executive Director of the Institute for Cyber Security, will be in Lyon, France on August 28, to give a talk for the 6th VLDB Workshop on Secure Data Management. His talk will be on an Access Control Language for a General Provenance Model, alongside fellow ICS colleague Shouhuai Xu. More on the workshop can be found here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS Startup SafeMashups Named Top 11 Security Company to Watch

SafeMashups, Inc., the latest startup from the Institute for Cyber Security Incubator to go live, has been named one of the eleven security companies to watch by NetworkWorld.

According to the article, SafeMashups is worth watching because its free Web Toolkit and SafeMashups Community Service can change today's mashups' lack of security controls. MashSSL is a protocol to allow one web app to talk to another through a browser in "mashups. There is a neat accompanying slideshow as well.

Look for more from SafeMashups in the coming months!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Amazon Announces Third Annual Startup Challenge

At the Institute for Cyber Security, our Incubator focuses on helping security startups benefit from the expertise and resources of our technical staff. As a result, we're always interested in new ways to advance a startup's mission. And of course, ICS loves contests. So when Amazon announced its new AWS startup challenge, we thought it sounded great!

First prize is $50,000 plus other accouterments provideed by Amazon. More information on the contest, as well as a link to their rules, can be found at their contest site. Maybe after collecting your winnings, your startup can be the next great idea to emerge from the ICS Incubator!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Data as a Service

About a year ago, Microsoft's SQL Azure (neé SQL Services (neé SQL Server Data Services)) was introduced to give customers a "pay-as-you-grow", scalable, and highly available database service, essentially offered as data as a service (DaaS). While not often mentioned as part of the triumverate of cloud computing (being infrastructure, platform, or software as a service), DaaS is one of those technologuies that is making headway without calling much attention to itself, and Microsoft (along with other services, such as Amazon's S3 platform) are making a real play for the domain. Microsoft just renamed their service today, no doubt to demonstrate its alignment to their Azure platform.

Relatedly, a year ago, Yahoo! announced YQL (the Yahoo! Query Language), a means that allows users to query and organize data across web data sources or services; essentially allowing SELECT statements. Today, YQL added INSERT, UPDATE, DELETE statements, now allowing developers write data back to other services. The Yahoo! Developer Network blog has some interesting tutorials on how to use their language and access their API.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Sears Adopts OpenID

In the biggest news for OpenID since Facebook's announcement that it would be a relying party, Sears announced that it would do the same. Customers will even have access to special offers and coupons in return for their participation in the community.

Up to this point, it'd been mostly technical organizations that had implemented OpenID. In a recent interview, Chris Messina had been expecting government entities to be relying parties as a way to bring OpenID into the mainstream, but perhaps the commercial sector may help OpenID's goals instead.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu