authUML: a three-phased framework to analyze access control specifications in use cases

ABSTRACT

Security requirements of a software product need to receive attention throughout its development life cycle. authUML is a framework based on logic programming that analyzes access control requirements in the requirements phase of the life cycle to ensure that they are consistent, complete and conflict-free. The framework is a customized version of Flexible Authorization Framework (FAF) of Jajodia et al. [9] suitable for Unified Modeling Language (UML) based requirement engineering. Our approach analyzes requirements on two levels: Use Cases and the conceptual operations [19]. authUML specifies policies to prevent inconsistent, incomplete and conflicting requirements before the developers proceed to the following phases of the development life cycle.

REFERENCES

• 1: K. Alghathbar, D. Wijesekera. Modeling Dynamic Role-based Access Constraints using UML. In proc. of the 1st International Conference on Software Engineering Research & Applications (ICSERA'03), San Francisco, CA. June 2003.
• 2: K. R. Apt , H. A. Blair , A. Walker, Towards a theory of declarative knowledge, Foundations of deductive databases and logic programming, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1988
• 3: Grady Booch , James Rumbaugh , Ivar Jacobson, The Unified Modeling Language user guide, Addison Wesley Longman Publishing Co., Inc., Redwood City, CA, 1999
• 4: G. Brose, M. Koch, K.-P. Löhr. Integrating Access Control Design into the Software Development Process. In the Proceedings of the sixth biennial world conference on the Integrated Design and Process Technology (IDPT), Pasadena, CA. June 2002.
• 5: Gerald Brose, A Typed Access Control Model for CORBA, Proceedings of the 6th European Symposium on Research in Computer Security, p.88-105, October 04-06, 2000
• 6: D. D. Clark, D. R. Wilson. A Comparison of Commercial and Military Computer Security Policies. IEEE Symposium on Security and Privacy 1987: 184-19.
• 7: Premkumar T. Devanbu , Stuart Stubblebine, Software engineering for security: a roadmap, Proceedings of the Conference on The Future of Software Engineering, p.227-239, June 04-11, 2000, Limerick, Ireland [doi>10.1145/336512.336559]
• 8: John E. Dobson, John A. McDermid: A Framework for Expressing Models of Security Policy. IEEE Symposium on Security and Privacy 1989: 229-241
• 9: E. Fernandez-Medina, A. Martinez, C. Medina, And M. Piattini. Integrating Multilevel Security in the Database Design Process. In the Proceedings of the sixth biennial world conference on the Integrated Design and Process Technology (IDPT), Pasadena, CA. June 2002.
• 10: Dov M. Gabbay , Anthony Hunter, Making inconsistency respectable: a logical framework for inconsistency in reasoning, Proceedings of the International Workshop on Fundamentals of Artificial Intelligence Research, p.19-32, September 08-13, 1991
• 11: Dov M. Gabbay , Anthony Hunter, Making Inconsistency Respectable: Part 2 - Meta-level handling of inconsistency, Proceedings of the European Conference on Symbolic and Quantitative Approaches to Reasoning and Uncertainty, p.129-136, November 08-10, 1993
• 12: M. Gelfond, V. Lifschitz. 1988. The stable model semantics for logic programming. In Proceedings, 5th International Conference and Symposium on Logic Programming. Seattle, Wash. pp. 1070-1080.
• 13: Sushil Jajodia , Pierangela Samarati , Maria Luisa Sapino , V. S. Subrahmanian, Flexible support for multiple access control policies, ACM Transactions on Database Systems (TODS), v.26 n.2, p.214-260, June 2001 [doi>10.1145/383891.383894]
• 14: Jan Jürjens, Towards Development of Secure Systems Using UMLsec, Proceedings of the 4th International Conference on Fundamental Approaches to Software Engineering, p.187-200, April 02-06, 2001
• 15: Torsten Lodderstedt , David A. Basin , Jürgen Doser, SecureUML: A UML-Based Modeling Language for Model-Driven Security, Proceedings of the 5th International Conference on The Unified Modeling Language, p.426-441, September 30-October 04, 2002
• 16: B. Nuseibeh, S. Easterbrook and A. Russo; "Making Respectable in Software Development", Journal of Systems and Software, 56(11), November 2001, Elsevier Science Publishers
• 17: Object Management Group. OMG Unified Modeling Language Specification, Version 1.4, 2001 http://www.omg.org/technology/documents/formal/uml. htm.
• 18: Ravi S. Sandhu , Edward J. Coyne , Hal L. Feinstein , Charles E. Youman, Role-Based Access Control Models, Computer, v.29 n.2, p.38-47, February 1996 [doi>10.1109/2.485845]
• 19: Shane Sendall, Alfred Strohmeier: From Use Cases to System Operation Specifications. UML 2000: 1-15.
• 20: S. Sendall. Specifying Reactive System Behavior, Ph.D. thesis, Swiss Federal Institute of Technology Lausanne (EPFL), May 2002
• 21: Jos Warmer , Anneke Kleppe, The object constraint language: precise modeling with UML, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1998

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.1 Requirements/Specifications

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.4 Software/Program Verification

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Languages, Security

Keywords:
Security engineering, access control policies, semi-formal methods, use cases