Formal Verification of Business Workflows and Role Based Access Control Systems

Dury, Arnaud; Boroday, Sergiy; Petrenko, Alexandre; Lotz, Volkmar

doi:10.1109/secureware.2007.4385334

Cited by 11 publications

(7 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…a∈A r∈R G(executed(a, r, intRating) ⇒ G(executed(a, r, extRating) ⇒ G ¬ activated(a, r))) (3) where R is the set of roles involved in the process and executed(a, r, t) abbreviates the formula (granted(a, r, t) ∧ X exec(a, t)). Thus instead of changing AWS 0 into a new access-controlled workflow system AWS 1 implementing the above mechanism and checking whether |= AWS 1 (1), we asked SATMC to check whether |= AWS 0 ((3) ⇒ (1)).…”

Section: Methodsmentioning

confidence: 99%

“…An approach to the combined modeling of business workflows with RBAC models is presented in [3]. The paper proposes an extended finite state machine model that allows for the model checking of SoD properties by using the model checker SPIN.…”

Section: Related Workmentioning

confidence: 99%

“…A natural question is whether model checking can be profitably used for the automatic analysis of security-sensitive business processes. Previous works [1][2][3] provide a positive answer to this question by showing that business processes under authorization constraints can be formally specified as transition systems and automatically analyzed by model checkers taken off the shelf. However the manual definition of the transition system starting from the workflow and the associated security policy is a complex and error-prone activity, which-if not carried out correctly-may undermine the significance of the whole method.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Model Checking of Security-Sensitive Business Processes

Armando

Ponta

2010

Formal Aspects in Security and Trust

View full text Add to dashboard Cite

Abstract. Security-sensitive business processes are business processes that must comply with security requirements (e.g. authorization constraints). In previous works it has been shown that model checking can be profitably used for the automatic analysis of security-sensitive business processes. But building a formal model that simultaneously accounts for both the workflow and the access control policy is a time consuming and error-prone activity. In this paper we present a new approach to model checking security-sensitive business processes that allows for the separate specification of the workflow and of the associated security policy while retaining the ability to carry out a fully automatic analysis of the process. To illustrate the effectiveness of the approach we describe its application to a version of the Loan Origination Process featuring an RBAC access control policy extended with delegation.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Model Checking of Security-Sensitive Business Processes

Armando

Ponta

2010

Formal Aspects in Security and Trust

View full text Add to dashboard Cite

show abstract

“…Dury et al [14] discussed an experimental result of applying a model checking technology for verifying RBAC on workflows. A modeling method is an effective example of applying a model checking.…”

Section: Related Workmentioning

confidence: 99%

Verifying Business Rules Using Model-Checking Techniques for Non-specialist in Model-Checking

Aoki

Matsuura

2014

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYSoftware programs often include many defects that are not easy to detect because of the developers' mistakes, misunderstandings caused by the inadequate definition of requirements, and the complexity of the implementation. Due to the different skill levels of the testers, the significant increase in testing person-hours interferes with the progress of development projects. Therefore, it is desireable for any inexperienced developer to identify the cause of the defects. Model checking has been favored as a technique to improve the reliability earlier in the software development process. In this paper, we propose a verification method in which a Java source code control sequence is converted into finite automata in order to detect the cause of defects by using the model-checking tool UP-PAAL, which has an exhaustive checking mechanism. We also propose a tool implemented by an Eclipse plug-in to assist general developers who have little knowledge of the model-checking tool. Because source code is generally complicated and large, the tool provides a step-wise verification mechanism based on the functional structure of the code and makes it easy to verify the business rules in the specification documents by adding a user-defined specification-based model to the source code model.

show abstract

“…Literatures [1][2][3] formally analyze and validate security strategy model, literature [4] validates the functional and authorization attributes using UML. Literature [5] utilizes formal method to validate security attributes of operating system.…”

Section: Introductionmentioning

confidence: 99%

Dynamically validate network security based on adaptive control theory

Lan¹,

Wang²,

Qing³

et al. 2013

2013 International Conference on Information and Network Security (ICINS 2013)

View full text Add to dashboard Cite

Network suffers from various types of security threats which are dynamic, and traditional static methods are difficult to effectively validate network security. A network security validation model based on adaptive control theory (NSVMAC) is proposed to validate network security in dynamic network environment. The Markov decision process is adopted to model the adaptive control of NSVMAC model, which is solved based on reinforcement learning method, and the adaptive optimization algorithm based on Q-Learning is proposed. The adaptability of NSVMAC model is analyzed in experiments, and confirms the effectiveness of the proposed method.

show abstract

Formal Verification of Business Workflows and Role Based Access Control Systems

Cited by 11 publications

References 16 publications

Model Checking of Security-Sensitive Business Processes

Model Checking of Security-Sensitive Business Processes

Verifying Business Rules Using Model-Checking Techniques for Non-specialist in Model-Checking

Dynamically validate network security based on adaptive control theory

Contact Info

Product

Resources

About