Security Aspects of Role-Based Communication Using WebRTC - Netto, Victor G.; Costa, Fábio M. (Companion Proceedings of the Brazilian Symposium on Cybersecurity (SBSeg); 2024: Companion Proceedings of the 24th Brazilian Symposium on Information and Computational Systems Security, 2024)
Model-driven approaches offer an effective way for non-IT experts to create complex software in different domains. One such domain is real-time communication, in which a high level modeling language is used to define communication sessions with non-trivial structure and behavior. Security concerns emerge naturally when implementing such a language. First, it is necessary to keep basic security requirements, such as confidentiality, integrity, and authentication. Second, it is necessary to enforce the communication constraints specified in session models. This paper presents an analysis of the security threats in the context of a communication modeling language called RBCML, which introduces a user role management layer on top of communication systems based on WebRTC. This work highlights the main threats in an RBCML implementation using WebRTC and proposes solutions for the security concerns pointed above.