Role Slices: A Notation for RBAC Permission Assignment and Enforcement

Pavlich-Mariscal, Jaime A.; Doan, Thuong; Michel, Laurent; Demurjian, Steven A.; Ting, T. C.

doi:10.1007/11535706_4

Cited by 7 publications

(12 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main criteria to identify a composable concern is to determine if its properties can be expressed as formal method preconditions. For example, in our current research [8,9], RBAC can be composed into an application, by doing permission checking as a precondition of the methods that need access control. 2.…”

Section: The Proposed Frameworkmentioning

confidence: 99%

“…Chosen RBAC as the first Security Concern Model, and in terms of UML, define roles whose positive permissions are a subset of the public methods of the application's class library, as reported in [8]. 2.…”

Section: Research Statusmentioning

confidence: 99%

“…2. Proposed a new UML artifact, the role-slice diagram, that allows a software/security engineer to capture the Security Concern Model for RBAC [8]. The role slice provides an abstraction to collect information on the permissions of a role that cuts across all classes in an application.…”

Section: Research Statusmentioning

confidence: 99%

“…4. Designed algorithms for mapping a role-slice diagram to AOP security enforcement code [8,9] via model composition [2] to manage role hierarchies.…”

Section: Research Statusmentioning

confidence: 99%

“…students based on earlier work described in [8,9]. The prototype integrates the role-slice diagram as well as other security work on extending UML with RBAC/MAC [4].…”

Section: Research Statusmentioning

confidence: 99%

See 4 more Smart Citations

A Framework for Composable Security Definition, Assurance, and Enforcement

Pavlich-Mariscal

Demurjian

Michel

2006

Satellite Events at the MoDELS 2005 Conference

Self Cite

View full text Add to dashboard Cite

Abstract. The objective of this research is to develop techniques that integrate alternative security concerns (e.g., mandatory access control, delegation, authentication, etc.) into the software process. The resulting model-driven framework preserves separation of security concerns from modeling through implementation, and allows security personnel to pick and choose security concerns to concerns promotes security assurance, and should result in a reduction of the security defects in the final system. To achieve separation of concerns at the modeling level, concern-specific languages are defined to capture alternative security concerns. At the implementation level, aspectoriented programming is used to integrate security concerns into an application's code, while preserving modularity. This composition seamlessly combines the chosen security concerns to realize an application's security infrastructure.

show abstract

Section: The Proposed Frameworkmentioning

confidence: 99%

Section: Research Statusmentioning

confidence: 99%

Section: Research Statusmentioning

confidence: 99%

“…4. Designed algorithms for mapping a role-slice diagram to AOP security enforcement code [8,9] via model composition [2] to manage role hierarchies.…”

Section: Research Statusmentioning

confidence: 99%

“…students based on earlier work described in [8,9]. The prototype integrates the role-slice diagram as well as other security work on extending UML with RBAC/MAC [4].…”

Section: Research Statusmentioning

confidence: 99%

See 3 more Smart Citations

A Framework for Composable Security Definition, Assurance, and Enforcement

Pavlich-Mariscal

Demurjian

Michel

2006

Satellite Events at the MoDELS 2005 Conference

Self Cite

View full text Add to dashboard Cite

show abstract

A Formal Enforcement Framework for Role-Based Access Control Using Aspect-Oriented Programming

Pavlich-Mariscal

Michel

Demurjian

2005

Model Driven Engineering Languages and Systems

View full text Add to dashboard Cite

Many of today's software applications require a high-level of security, defined by a detailed policy and attained via mechanisms such as role-based access control (RBAC), mandatory access control, digital signatures, etc. The integration of the design/implementation processes of access-control policies with runtime enforcement mechanisms is crucial to achieve an acceptable level of security for a software application. Our prior research focused on formalizing the concept of a role slice, which is a unified modeling language (UML) artifact that captures RBAC security requirements by defining permissions in the form of allowable or prohibited methods, and by specifying roles as specialized class diagrams that contain those methods. This paper augments this effort by introducing a formal framework for the security of software applications that supports the automatic translation of a role-slice access-control policy (RBAC requirements) into aspect-oriented programming (AOP) enforcement code that is seamlessly integrated with the application. The formal framework provides the necessary underpinnings to automate the integration of security policies into software. A prototyping effort based on Borland's UML tool Together Control Center for defining role-slice diagrams and the associated AOP code generator is under development.

show abstract

Model-driven run-time enforcement of complex role-based access control policies

Fadhel

Bianculli

Briand

2018

Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering

View full text Add to dashboard Cite

A Role-based Access Control (RBAC) mechanism prevents unauthorized users to perform an operation, according to authorization policies which are defined on the user's role within an enterprise. Several models have been proposed to specify complex RBAC policies. However, existing approaches for policy enforcement do not fully support all the types of policies that can be expressed in these models, which hinders their adoption among practitioners.In this paper we propose a model-driven enforcement framework for complex policies captured by GemRBAC+CTX, a comprehensive RBAC model proposed in the literature. We reduce the problem of making an access decision to checking whether a system state (from an RBAC point of view), expressed as an instance of the Gem-RBAC+CTX model, satisfies the constraints corresponding to the RBAC policies to be enforced at run time. We provide enforcement algorithms for various types of access requests and events, and a prototype tool (MORRO) implementing them. We also show how to integrate MORRO into an industrial Web application. The evaluation results show the applicability of our approach on a industrial system and its scalability with respect to the various parameters characterizing an AC configuration. CCS CONCEPTS• Security and privacy → Access control; • Software and its engineering → Model-driven software engineering; KEYWORDS role-based access control, enforcement, policies, model-driven engineering ACM Reference Format:

show abstract

Role Slices: A Notation for RBAC Permission Assignment and Enforcement

Cited by 7 publications

References 16 publications

A Framework for Composable Security Definition, Assurance, and Enforcement

A Framework for Composable Security Definition, Assurance, and Enforcement

A Formal Enforcement Framework for Role-Based Access Control Using Aspect-Oriented Programming

Model-driven run-time enforcement of complex role-based access control policies

Contact Info

Product

Resources

About