From Access Control Policies to an Aspect-Based Infrastructure: A Metamodel-Based Approach
نویسنده
چکیده
Security is among the most successful applications of aspectoriented concepts. In particular, in role-based access control, aspects capture access conditions in a quite modular way. The question we address in this paper is how can aspects be generated from access control policies under a validated process? We present a metamodel-based transformation from SecureUML, a rolebased access control language, to an abstract aspect language. Within this model-driven engineering context, a security policy is represented as an instance of SecureUML’s metamodel and the generated aspect is represented as an instance of the abstract aspect language metamodel. Invariants specified on the merged metamodel of SecureUML and the abstract aspect language are checked to validate the generated aspect with respect to the given security policy. We have prototyped our approach as a Java application on top of ITP/OCL, a rewriting-based OCL evaluator. It outputs validated AspectJ code from a SecureUML policy.
منابع مشابه
An automatic test case generator for evaluating implementation of access control policies
One of the main requirements for providing software security is the enforcement of access control policies which aim to protect resources of the system against unauthorized accesses. Any error in the implementation of such policies may lead to undesirable outcomes. For testing the implementation of access control policies, it is preferred to use automated methods which are faster and more relia...
متن کاملRewrite Specifications of Access Control Policies in Distributed Environments
We define a metamodel for access control that takes into account the requirements of distributed environments, where resources and access control policies may be distributed across several sites. This distributed metamodel is an extension of the category-based metamodel proposed in previous work (from which standard centralised access control models such as MAC, DAC, RBAC, Bell-Lapadula, etc. c...
متن کاملEnforcing RBAC Policies over Data Stored on Untrusted Server (Extended Version)
One of the security issues in data outsourcing is the enforcement of the data owner’s access control policies. This includes some challenges. The first challenge is preserving confidentiality of data and policies. One of the existing solutions is encrypting data before outsourcing which brings new challenges; namely, the number of keys required to access authorized resources, efficient policy u...
متن کاملMutating DAC and MAC Security Policies: A Generic Metamodel Based Approach
In this paper we show how DAC and MAC security policies can be specified, implemented and validated through mutation testing using a generic approach. This work is based on a generic security framework originally designed to support RBAC and OrBAC security policies and their implementation in Java applications.
متن کاملA Model-Based Framework for Security Policy Specification, Deployment and Testing
In this paper, we propose a model-driven approach for specifying, deploying and testing security policies in Java applications. First, a security policy is specified independently of the underlying access control language (OrBAC, RBAC). It is based on a generic security meta-model which can be used for early consistency checks in the security policy. This model is then automatically transformed...
متن کامل