Modeling process-related RBAC models with extended UML activity models

Information and Software Technology

Volumn 53, Issue 5, 2011, Pages 456-483

  Strembeck, Mark ^a   Mendling, Jan ^b,c  

^a VIENNA UNIVERSITY OF ECONOMICS AND BUSINESS   (Austria)

^b HUMBOLDT UNIVERSITY   (Germany)

^c NONE   (Germany)

Author keywords

Process modeling; Role engineering; Role based access control; Systems modeling; UML

Indexed keywords

PROCESS MODELING; ROLE ENGINEERING; ROLE-BASED ACCESS CONTROL; SYSTEMS MODELING; UML;

COMPUTER SOFTWARE; MODELS; SECURITY SYSTEMS;

ACCESS CONTROL;

EID: 79952439750     PISSN: 09505849     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.infsof.2010.11.015     Document Type: Conference Paper

References (103)

1. W.M.P. van der Aalst Formalization and verification of event-driven process chains Information and Software Technology 41 10 1999
2. W.M.P. van der Aalst, and A.H.M. ter Hofstede YAWL: yet another workflow language Information Systems 30 4 2005
3. G.J. Ahn, and R. Sandhu Role-based authorization constraints specification ACM Transactions on Information and System Security (TISSEC) 3 4 2000
4. G.J. Ahn, M.E. Shin, Role-based authorization constraints specification using object constraint language, in: Proceedings of the 10th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), June 2001.
5. M. Alam, M. Hafner, and R. Breu Constraint based role based access control in the SECTET-framework - a model-driven approach Journal of Computer Security 16 2 2008
6. B. Axenath, E. Kindler, V. Rubin, AMFIBIA: a meta-model for the integration of business process modelling aspects, in: F. Leymann, W. Reisig, S.R. Thatte, W. van der Aalst (Eds.), The Role of Business Processes in Service Oriented Architectures, No. 06291 in Dagstuhl Seminar Proceedings, 2006.
7. D. Basin, J. Doser, and T. Lodderstedt Model driven security: from UML models to access control infrastructures ACM Transactions on Software Engineering and Methodology (TOSEM) 15 1 2006
8. J. Becker, M. Rosemann, and C. von Uthmann Guidelines of business process modeling Business Process Management, Models, Techniques, and Empirical Studies Lecture Notes in Computer Science (LNCS) vol. 1806 2000 Springer Verlag
9. E. Bertino, J. Crampton, F. Paci, Access control and authorization constraints for WS-BPEL, in: Proceedings of the IEEE International Conference on Web Services (ICWS), September 2006.
10. E. Bertino, E. Ferrari, and V. Atluri The specification and enforcement of authorization constraints in workflow management systems ACM Transactions on Information and System Security (TISSEC) 2 1 1999
11. R.A. Botha, and J.H.P. Eloff Separation of duties for access control enforcement in workflow environments IBM Systems Journal 40 3 2001
12. R. Breu, G. Popp, and M. Alam Model based development of access policies International Journal on Software Tools for Technology Transfer 9 5-6 2007
13. J.C. Cannon, and M. Byers Compliance deconstructed ACM Queue 4 7 2006
14. D.D. Clark, D.R. Wilson, A comparison of commercial and military computer security policies, in: Proceedings of the IEEE Symposium on Security and Privacy, April 1987.
15. J. Cortadella, M. Kishinevsky, L. Lavagno, and A. Yakovlev Deriving petri nets from finite transition systems IEEE Transactions on Computers 47 1998
16. E.J. Coyne, and J.M. Davis Role Engineering for Enterprise Security Management 2008 Artech House
17. J. Crampton, H. Khambhammettu, Delegation and satisfiability in workflow systems, in: Proceedings of the 13th ACM Symposium on Access Control Models and Technologies (SACMAT), June 2008.
18. M. Damianides How does SOX change IT? Journal of Corporate Accounting & Finance 15 6 2004
19. R.M. Dijkman, M. Dumas, and C. Ouyang Semantics and analysis of business process models in BPMN Information & Software Technology 50 12 2008
20. P. Epstein, R. Sandhu, Towards a UML based approach to role engineering, in: Proceedings of the 4th ACM Workshop on Role-Based Access Control, October 1999.
21. R. Eshuis, and R. Wieringa Tool support for verifying UML activity diagrams IEEE Transactions on Software Engineering (TSE) 30 7 2004
22. D.F. Ferraiolo, J.F. Barkley, and D.R. Kuhn A role-based access control model and reference implementation within a corporate Intranet ACM Transactions on Information and System Security (TISSEC) 2 1 1999
23. D.F. Ferraiolo, D.R. Kuhn, Role-based access controls, in: Proceedings of the 15th National Computer Security Conference, October 1992.
24. D.F. Ferraiolo, D.R. Kuhn, and R. Chandramouli Role-Based Access Control second ed. 2007 Artech House
25. T. Fink, M. Koch, K. Pauls, An MDA approach to access control specifications using MOF and UML profiles, in: Proceedings of the First International Workshop on Views on Designing Complex Architectures (VODCA), Electronic Notes in Theoretical Computer Science, vol. 142, January 2006, pp. 161-179. (Pubitemid 41828098)
26. M.P. Gallaher, A.C. O'Connor, B. Kropp, The Economic Impact of Role-Based Access Control, National Institute of Standards & Technology (NIST), Planning Report 02-1, March 2002.
27. C.K. Georgiadis, I. Mavridis, G. Pangalos, R.K. Thomas, Flexible team-based access control using contexts, in: Proceedings of the 6th ACM Symposium on Access Control Models and Technologies (SACMAT), May 2001.
28. K. Irwin, T. Yu, W.H. Winsborough, Enforcing security properties in task-based systems, in: Proceedings of the 13th ACM Symposium on Access Control Models and Technologies (SACMAT), June 2008.
29. ISO, Information technology - Security techniques - Code of practice for information security management, ISO/IEC 27002:2005, Stage: 90.92, April 2008, < http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue-detail.htm? csnumber=50297 >.
30. ISO, Information technology - Security techniques - Information security management systems - Requirements, ISO/IEC 27001:2005, Stage: 90.92, October 2008, < http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue-detail. htm?csnumber=42103 >.
31. ISO, Information technology - Security techniques - Information security management systems - Overview and vocabulary, ISO/IEC 27000:2009, Stage: 60.60, April 2009, < http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue- detail.htm?csnumber=41933 >.
32. J. Jürjens Secure Systems Development with UML 2005 Springer Verlag
33. J. Jürjens, Sound methods and effective tools for model-based security engineering with UML, in: Proceedings of the 27th International Conference on Software Engineering (ICSE), May 2005.
34. J. Jürjens Model-based run-time checking of security permissions using guarded objects Proceedings of the 8th International Workshop on Runtime Verification Lecture Notes in Computer Science (LNCS) vol. 5289 2008 Springer Verlag
35. J. Jürjens, M. Lehrhuber, G. Wimmel, Model-based design and analysis of permission-based security, in: Proceedings of the 10th International Conference on Engineering of Complex Computer Systems (ICECCS), June 2005.
36. S.K. Kim, D. Burger, and D.A. Carrington An MDA approach towards integrating formal and informal modeling languages International Symposium of Formal Methods Europe Lecture Notes in Computer Science (LNCS) vol. 3582 2005 Springer Verlag 448 464 (Pubitemid 41436073)
37. E. Kindler On the semantics of EPCs: resolving the vicious circle Data & Knowledge Engineering (DKE) 56 1 2006
38. M. Koch, and F. Parisi-Presicce UML specification of access control policies and their formal verification Software and System Modeling 5 4 2006 429 447 (Pubitemid 44824555)
39. S. Kunz, S. Evdokimov, B. Fabian, B. Stieger, M. Strembeck, Role-based access control for information federations in the industrial service sector, in: Proceedings of the 18th European Conference on Information Systems (ECIS), June 2010.
40. C.E. Landwehr Formal models for computer security ACM Computing Surveys 13 3 1981
41. F. Leymann, and D. Roller Production Workflow - Concepts and Techniques 2000 Prentice Hall
42. N. Li, M.V. Tripunitara, and Z. Bizri On mutually exclusive roles and separation-of-duty ACM Transactions on Information and System Security (TISSEC) 10 2 2007
43. N. Li, and Q. Wang Beyond separation of duty: an algebra for specifying high-level security policies Journal of the ACM (JACM) 55 3 2008
44. B. List, B. Korherr, An evaluation of conceptual business process modelling languages, in: Proceedings of the 21st ACM Symposium on Applied Computing (SAC), April 2006.
45. N. Lohmann, E. Verbeek, and R.M. Dijkman Petri net transformations for business processes - a survey Transactions on Petri Nets and Other Models of Concurrency 2 2009
46. J. Mendling Metrics for Process Models: Empirical Foundations of Verification, Error Prediction and Guidelines for Correctness Lecture Notes in Business Information Processing (LNBIP) vol. 6 2008 Springer Verlag
47. J. Mendling, and W.M.P. van der Aalst Formalization and verification of EPCs with OR-joins based on state and context J. Krogstie, A.L. Opdahl, G. Sindre, Proceedings of the 19th Conference on Advanced Information Systems Engineering (CAiSE) Lecture Notes in Computer Science vol. 4495 2007 Springer Verlag Trondheim, Norway
48. J. Mendling, K. Ploesser, and M. Strembeck Specifying separation of duty constraints in BPEL4People processes Proceedings of the 11th International Conference on Business Information Systems (BIS) Lecture Notes in Business Information Processing (LNBIP) vol. 7 2008 Springer-Verlag
49. J. Mendling, M. Strembeck, G. Stermsek, G. Neumann, An approach to extract RBAC models from BPEL4WS processes, in: Proceedings of the 13th IEEE International Workshops on Enabling Technologies: Infrastructures for Collaborative Enterprises (WETICE), June 2004.
50. T. Mens, and P. Van Gorp A taxonomy of model transformation Electronic Notes in Theoretical Computer Science 152 2006 125 142
51. M. Mernik, J. Heering, and A.M. Sloane When and how to develop domain-specific languages ACM Computing Surveys 37 4 2005 316 344 (Pubitemid 43898543)
52. S. Mishra, and H.R. Weistroffer A framework for integrating Sarbanes-Oxley compliance into the systems development process Communications of the Association for Information Systems (CAIS) 20 1 2007
53. T. Murata Petri nets: properties, analysis and applications Proceedings of the IEEE 77 4 1989
54. G. Neumann, M. Strembeck, A scenario-driven role engineering process for functional RBAC roles, in: Proceedings of 7th ACM Symposium on Access Control Models and Technologies (SACMAT), June 2002.
55. NIST, An Introduction to Computer Security: The NIST Handbook, National Institute of Standards& Technology (NIST), Special Publication 800-12, October 1995, < http://csrc.nist.gov/publications/nistpubs/800-12/handbook. pdf >.
56. NIST, Recommended Security Controls for Federal Information Systems and Organizations, National Institute of Standards & Technology (NIST), Special Publication 800-53, Revision 3, August 2009, < http://csrc.nist.gov/ publications/nistpubs/800-53-Rev3/sp800-53-rev3-final-errata.pdf >.
57. S. Oh, and S. Park Task-role-based access control model Information Systems 28 6 2003
58. OMG, Object Constraint Language Specification, Version 2.0, formal/06-05-01, The Object Management Group, May 2006, < http://www.omg.org/technology/documents/formal/ocl.htm >.
59. OMG, Business Process Modeling Notation (BPMN), Version 1.2, formal/2009-01-03, The Object Management Group, January 2009, < http://www.omg.org/spec/BPMN/1.2/ >.
60. OMG, Meta Object Facility (MOF): Core Specification, Version 2.0, formal/06-01-01, The Object Management Group, January 2006, < http://www.omg.org/spec/MOF/2.0/ >.
61. OMG, Unified Modeling Language (OMG UML): Superstructure, Version 2.2, formal/2009-02-02, The Object Management Group, February 2009, < http://www.omg.org/technology/documents/formal/uml.htm >.
62. C. Ouyang, M. Dumas, W.M.P. van der Aalst, A.H.M. ter Hofstede, and J. Mendling From business process models to process-oriented software systems ACM Transactions on Software Engineering and Methodology (TOSEM) 19 1 2009
63. J.L. Peterson Petri nets ACM Computing Surveys (CSUR) 9 3 1977 223 252
64. C.A. Petri, Fundamentals of a theory of asynchronous information flow, in: Proceedings of the Information Processing Congress (IFIP Congress), August/September 1962.
65. I. Ray, N. Li, R. France, D.K. Kim, Using UML to visualize role-based access control constraints, in: Proceedings of the 9th ACM Symposium on Access Control Models and Technologies (SACMAT), June 2004.
66. A. Rodríguez, E. Fernández-Medina, and M. Piattini Capturing security requirements in business processes through a UML 2.0 activity diagrams profile Workshop Proceedings of Advances in Conceptual Modeling - Theory and Practice (ER Workshops) Lecture Notes in Computer Science (LNCS) vol. 4231 2006 Springer Verlag 32 42 (Pubitemid 44850617)
67. Alfonso Rodríguez, Eduardo Fernández-Medina, and Mario Piattini A BPMN extension for the modeling of security requirements in business processes IEICE Transactions on Information and Systems 90-D 4 2007 745 752 (Pubitemid 46600133)
68. N. Russell, W.M.P. van der Aalst, A.H.M. ter Hofstede, and D. Edmond Workflow resource patterns: identification, representation and tool support O. Pastor, J. Falcão e Cunha, Proceedings of the 17th International Conference on Advanced Information Systems Engineering, CAiSE 2005, Porto, Portugal, June 13-17, 2005 Lecture Notes in Computer Science vol. 3520 2005 Springer 216 232 (Pubitemid 41336105)
69. N. Russell, W.M.P. van der Aalst, A.H.M. ter Hofstede, P. Wohed, On the suitability of UML 2.0 activity diagrams for business process modelling, in: Proceedings of the Third Asia-Pacific Conference on Conceptual Modelling (APCCM), January 2006.
70. R.S. Sandhu, E.J. Coyne, H.L. Feinstein, and C.E. Youman Role-based access control models IEEE Computer 29 2 1996
71. R.S. Sandhu, and P. Samarati Access control: principles and practice IEEE Communications 32 9 1994
72. A.W. Scheer ARIS - Business Process Modeling 3rd ed. 2000 Springer Verlag
73. Douglas C. Schmidt Model-driven engineering - guest editor's introduction Computer 39 2 2006
74. B. Selic The pragmatics of model-driven development IEEE Software 20 5 2003
75. S. Sendall, and W. Kozaczynski Model transformation: the heart and soul of model-driven software development IEEE Software 20 5 2003
76. M.E. Shin, G.J. Ahn, UML-based representation of role-based access control, in: Proceedings of the 9th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), June 2000.
77. K. Sohr, G.J. Ahn, M. Gogolla, and L. Migge Specification and validation of authorisation constraints using UML and OCL Proceedings of the 10th European Symposium on Research in Computer Security (ESORICS) Lecture Notes in Computer Science (LNCS) vol. 3679 2005 Springer Verlag
78. K. Sohr, M. Drouineaud, G.J. Ahn, and M. Gogolla Analyzing and managing role-based access control policies IEEE Transactions on Knowledge and Data Engineering 20 7 2008 924 939
79. K. Sohr, T. Mustafa, X. Bao, G.J. Ahn, Enforcing role-based access control policies in web services with UML and OCL, in: Proceedings of the 2008 Annual Computer Security Applications Conference (ACSAC), December 2008.
80. D. Spinellis Notable design patterns for domain-specific languages Journal of Systems and Software 56 1 2001 91 99 (Pubitemid 33649529)
81. Thomas Stahl, and Markus Völter Model-Driven Software Development 2006 John Wiley & Sons
82. E.A. Stohr, and J.L. Zhao Workflow automation: overview and research issues Information Systems Frontiers 3 3 2001
83. M. Strembeck, Conflict checking of separation of duty constraints in RBAC - implementation experiences, in: Proceedings of the Conference on Software Engineering (SE 2004), February 2004.
84. M. Strembeck, A role engineering tool for role-based access control, in: Proceedings of the 3rd Symposium on Requirements Engineering for Information Security (SREIS), August 2005.
85. M. Strembeck, Embedding policy rules for software-based systems in a requirements context, in: Proceedings of the IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY), June 2005.
86. M. Strembeck Scenario-driven role engineering IEEE Security & Privacy 8 1 2010
87. M. Strembeck, and J. Mendling Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context Proceedings of the 18th International Conference on Cooperative Information Systems (CoopIS) Lecture Notes in Computer Science (LNCS) vol. 6426 2010 Springer Verlag
88. M. Strembeck, and G. Neumann An integrated approach to engineer and enforce context constraints in RBAC environments ACM Transactions on Information and System Security (TISSEC) 7 3 2004
89. M. Strembeck, and U. Zdun An approach for the systematic development of domain-specific languages Software: Practice and Experience (SP&E) 39 15 2009
90. K. Tan, J. Crampton, C.A. Gunter, The consistency of task-based authorization constraints in workflow systems, in: Proceedings of the 17th IEEE Workshop on Computer Security Foundations (CSFW), June 2004.
91. R.K. Thomas, Team-based access control (TMAC): a primitive for applying role-based access controls in collaborative environments, in: Proceedings of the ACM Workshop on Role Based Access Control, 1997.
92. R.K. Thomas, R.S. Sandhu, Task-based authorization controls (TBAC): a family of models for active and enterprise-oriented authorization management, in: Proceedings of the IFIP WG11.3 Conference on Database Security, August 1997.
93. A. Valmari The state explosion problem Lectures on Petri Nets I: Basic Models, Advances in Petri Nets, the volumes are based on the Advanced Course on Petri Nets, held in Dagstuhl, September 1996 Lecture Notes in Computer Science (LNCS) vol. 1491 1998 Springer Verlag
94. K. van Hee, O. Oanea, A. Serebrenik, N. Sidorova, and M. Voorhoeve History-based joins: semantics, soundness and implementation Data & Knowledge Engineering (DKE) 64 1 2008
95. J. Wainer, P. Barthelmes, and A. Kumar W-RBAC - a workflow security model incorporating controlled overriding of constraints International Journal of Cooperative Information Systems (IJCIS) 12 4 2003
96. H. Wang, Y. Zhang, J. Cao, and J. Yang Specifying role-based access constraints with object constraint language Proceedings of the 6th Asia-Pacific Conference Advanced Web Technologies and Applications Lecture Notes in Computer Science (LNCS) vol. 3007 2004 Springer Verlag
97. J. Warner, V. Atluri, Inter-instance authorization constraints for secure workflow management, in: Proceedings of the 11th ACM Symposium on Access Control Models and Technologies (SACMAT), June 2006.
98. P. Wohed, W.M.P. van der Aalst, M. Dumas, A.H.M. ter Hofstede, and N. Russell On the suitability of BPMN for business process modelling Proceedings of the 4th International Conference on Business Process Management (BPM) Lecture Notes in Computer Science (LNCS) vol. 4102 2006 Springer Verlag
99. C. Wolter, M. Menzel, A. Schaad, P. Miseldine, and C. Meinel Model-driven business process security requirement specification Journal of Systems Architecture 55 4 2009
100. C. Wolter, and A. Schaad Modeling of task-based authorization constraints in BPMN G. Alonso, P. Dadam, M. Rosemann, 5th International Conference on Business Process Management (BPM) Lecture Notes in Computer Science vol. 4714 2007 Springer 64 79
101. U. Zdun Patterns of component and language integration D. Manolescu, M. Voelter, J. Noble, Pattern Languages of Program Design vol. 5 2006 Addison Wesley
102. U. Zdun, and M. Strembeck Modeling composition in dynamic programming environments with model transformations Proceedings of the 5th International Symposium on Software Composition Lecture Notes in Computer Science (LNCS) vol. 4089 2006 Springer-Verlag
103. U. Zdun, M. Strembeck, Reusable architectural decisions for DSL design: foundational decisions in DSL projects, in: Proceedings of the 14th European Conference on Pattern Languages of Programs (EuroPLoP), July 2009.