Using Parameterized UML to Specify and Compose Access Control Models (2003)
| Venue: | In Proceedings of the 6th IFIP TC-11 WG 11.5 Working Conference on Integrity and Internal Control in Information Systems (IICIS |
| Citations: | 16 - 4 self |
BibTeX
@INPROCEEDINGS{Ray03usingparameterized,
author = {Indrakshi Ray and Na Li and Dae-kyoo Kim and Robert France},
title = {Using Parameterized UML to Specify and Compose Access Control Models},
booktitle = {In Proceedings of the 6th IFIP TC-11 WG 11.5 Working Conference on Integrity and Internal Control in Information Systems (IICIS},
year = {2003},
pages = {13--14}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract: Situations can arise in which organizations have to merge policies that are based on different access control frameworks, such as Role Based Access Control (RBAC) and Mandatory Access Control (MAC). Integrating policies requires addressing the following question: How will the integration impact access to protected resources? In particular, one needs to determine that the integration does not result in security breaches or unavailability of resources. A way of addressing these concerns is to model the access control frameworks, compose the models, and analyze the resulting model to identify problems. In this paper we outline a technique for modeling and composing access control policy frameworks. Specifically, we model RBAC and MAC using a variant of the Unified Modeling Language (UML) and show how to compose the models. The composed model can be used as a base for defining access control policies in a military domain. Key words: Mandatory Access Control, Role-Based Access Control, Unified Modeling Language 1.
Citations
| 300 | Proposed NIST Standard for RoleBased Access Control - Ferraiolo, Sandhu, et al. - 2001 |
| 148 | Access Control: Principles and Practice - Sandhu, Samarati - 1994 |
| 116 | SecureUML: A UML-Based Modeling Language for Model-Driven Security - Lodderstedt, Basin, et al. - 2002 |
| 102 | Lattice-based access controls - Sandhu - 1993 |
| 82 | UMLsec: Extending UML for Secure Systems Development - Jurjens - 2002 |
| 56 | A security model for military message systems - LANDWEHR, HEITMEYER, et al. - 1984 |
| 34 | Modeling Mandatory Access Control in RoleBased Security Systems - Nyanchama, Osborn - 1997 |
| 28 | Mandatory Access Control and Role-Based Access Control Revisited - Osborn - 1997 |
| 3 | Toward Information Assurance in Dynamic Coalitions - Phillips, Demurjian, et al. - 2002 |
