A rigorous approach to uncovering security policy violations in UML designs

Proceedings of the IEEE International Conference on Engineering of Complex Computer Systems, ICECCS

Volumn , Issue , 2009, Pages 126-135

  Yu, Lijun ^a   France, Robert ^a   Ray, Indrakshi ^a   Ghosh, Sudipto ^a  

^a Veterinary Dentistry and Oral Surgery   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

MODEL CHECKING; SECURITY SYSTEMS;

ANALYSIS TECHNIQUES; ANALYSIS TOOLS; EXTERNAL SOURCES; MODEL-CHECKING TECHNIQUES; RIGOROUS ANALYSIS; RIGOROUS APPROACH; SCENARIO-BASED; SECURITY POLICY; UML DESIGN; WORLD VIEWS;

ACCESS CONTROL;

EID: 70350143484     PISSN: 27708527     EISSN: 27708535     Source Type: Conference Proceeding    
DOI: 10.1109/ICECCS.2009.16     Document Type: Conference Paper

References (24)

1. Object Management Group, Unified Modeling Language: Superstructure, version 2.0 Final Adopted Standard.
2. Object Management Group, Object Constraint Language Specification, Version 2.0.
3. Ahn, G. and Shin, M. E. 2001. "Role-Based Authorization Constraints Specification Using Object Constraint Language". In Proceedings of the 10th IEEE international Workshops on Enabling Technologies: infrastructure For Collaborative Enterprises (June 20 - 22, 2001). WETICE. IEEE Computer Society, Washington, DC, 157-162.
4. Epstein, P. and Sandhu, R. 1999. "Towards a UML based approach to role engineering". In Proceedings of the Fourth ACM Workshop on Role-Based Access Control (Fairfax, Virginia, United States, October 28 - 29, 1999). RBAC '99. ACM, New York, NY, 135-143. DOI= http://doi.acm.org/10. 1145/319171.319184
5. Ray, I., Li, N., France, R., and Kim, D. 2004. "Using UML to visualize role-based access control constraints". In Proceedings of the Ninth ACM Symposium on Access Control Models and Technologies, Yorktown Heights, New York, USA, June 02 - 04, 2004.
6. D.F. Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn, and R. Chandramouli. "Proposed NIST Standard for Role-Based Access Control". ACM Transactions on Information and Systems Security, 4(3), Aug. 2001.
7. Lijun Yu, Robert France, Indrakshi Ray, Kevin Lano, "A Light-weight Static Approach to Analyzing UML Behavioral Properties", Proceedings of the International Conference on Engineering Complex Computer Systems (ICECCS 2007), Auckland, New Zealand, July 2007.
8. Lijun Yu, Robert France, Indrakshi Ray, "Scenario-based Static Analysis of UML Class Models", Proceedings of ACM/IEEE 11th International Conference on Model Driven Engineering Languages and Systems (MODELS 2008), Toulouse, France, Sep. 28-Oct.3, 2008.
9. T. Dinh-Trong, N. Kawane, S. Ghosh, R. B. France, and A. A. Andrews. "A Tool-Supported Approach to Testing UML Design Models", Proceedings of the 10th IEEE International Conference on Engineering of Complex Computer Systems, IEEE Computer Society Press, pp. 519-528, Shanghai, China, June 16-20, 2005.
10. Gogolla, M., Büttner, F., and Richters, M. 2007. "USE: A UML-based specification environment for validating UML and OCL". Sci. Comput. Program. 69, 1-3, Dec. 2007.
11. D. Chiorean, M. Pasca, A. Cârcu, C. Botiza, S. Moldovan, "Ensuring UML Models Consistency Using the OCL Environment", Electronic Notes in Theoretical Computer Science, Volume 102, Nov. 2004, pages 99-110.
12. Sohr, K., Drouineaud, M., Ahn, G., and Gogolla, M. 2008. "Analyzing and Managing Role-Based Access Control Policies". IEEE Trans. on Knowl. and Data Eng. 20, 7 (Jul. 2008), 924-939. DOI= http://dx.doi.org/10.1109/ TKDE.2008.28
13. Zao, J., Wee, H., Chu, J., Jackson, D.: RBAC Schema Verification Using Lightweight Formal Model and Constraint Analysis. Submitted to SACMAT 2003, http://alloy.mit.edu/contributions/RBAC.pdf
14. D. Jackson, "Alloy: a lightweight object modeling notation", ACM Transactions on Software Engineering and Methodology, Volume 11, Issue 2, April 2002, pages 256-290.
15. Eunjee Song, Raghu Reddy, Robert France, Indrakshi Ray, Geri Georg, Roger Alexander, "Verifiable Composition of Access Control Features and Applications", Proceedings of the 10th ACM Symposium on Access Control Models and Technologies (SACMAT 2005), Scandic Hasselbacken, Stockholm, June 1-3, 2005.
16. Eunjee Song, Robert France, Indrakshi Ray, and Hanil Kim, "Checking Policy Enforcement in an Access Control Aspect Model", Proceedings of the International Conference on Convergence Technology and Information Convergence (CTIC) '07, Anaheim, California, November 2007.
17. Nan Zhang, Mark D. Ryan and Dimitar Guelev, "Evaluating Access Control Policies Through Model Checking". Eighth Information Security Conference (ISC'05). Lecture Notes in Computer Science volume 3650, pages 446-460, Springer-Verlag, 2005.
18. Schaad, A., Lotz, V., and Sohr, K. 2006. "A model-checking approach to analysing organisational controls in a loan origination process". In Proceedings of the Eleventh ACM Symposium on Access Control Models and Technologies (Lake Tahoe, California, USA, June 07 - 09, 2006). SACMAT '06. ACM, New York, NY, 139-149. DOI= http://doi.acm.org/10.1145/1133058.1133079
19. Jim Davies and Jim Woodcock (1996). Using Z: Specification, Refinement and Proof. Prentice Hall International Series in Computer Science. ISBN 0-13-948472-8. http://www.usingz.com/text/online/
20. Ermel, C., Holscher, K., Kuske, S., and Ziemann, P. 2005. "Animated Simulation of Integrated UML Behavioral Models Based on Graph Transformation". In Proceedings of the 2005 IEEE Symposium on Visual Languages and Human-Centric Computing (September 20 - 24, 2005). VLHCC. IEEE Computer Society, Washington, DC, 125-133. DOI= http://dx.doi.org/10.1109/ VLHCC.2005.18
21. Patricio Letelier Torres, Pedro Sánchez, "Validation of UML Classes through Animation", In Proceedings of the International Workshop on Conceptual Modeling Quality, IWCMQ'02, pp. 61-73.
22. Oliver, I. 1999. "Validation of Object Oriented Models Using Animation". In Proceedings of the Workshop on Object-Oriented Technology (June 14 - 18, 1999). A. M. Moreira and S. Demeyer, Eds. Lecture Notes In Computer Science, vol. 1743. Springer-Verlag, London, 375-376.
23. Lilius, J.; Paltor, I.P., "vUML: a tool for verifying UML models", Automated Software Engineering, 1999. 14th IEEE International Conference on, Oct 1999 Page(s):255-258.
24. Jürjens, J. 2002. "UMLsec: Extending UML for Secure Systems Development". In Proceedings of the 5th international Conference on the Unified Modeling Language (September 30 - October 04, 2002).