Bridging the gap between role mining and role engineering via migration guides

Information Security Technical Report

Volumn 17, Issue 4, 2013, Pages 148-172

  Baumgrass, Anne ^a   Strembeck, Mark ^a  

^a VIENNA UNIVERSITY OF ECONOMICS AND BUSINESS   (Austria)

Author keywords

Migration; Model comparison; RBAC; Role engineering; Role mining

Indexed keywords

MIGRATION; MODEL COMPARISON; RBAC; ROLE ENGINEERING; ROLE MININGS;

INFORMATION SYSTEMS;

ACCESS CONTROL;

EID: 84878317740     PISSN: 13634127     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.istr.2013.03.003     Document Type: Conference Paper

References (88)

1. G.J. Ahn, and R. Sandhu Role-based authorization constraints specification ACM Transactions on Information and System Security (TISSEC) 3 4 2000
2. K. Altmanninger, M. Seidl, and M. Wimmer A survey on model versioning approaches International Journal of Web Information Systems 5 3 2009
3. Backes M, Karjoth G, Bagga W, Schunter M. Efficient comparison of enterprise privacy policies. In: Proc. of the 2004 ACM Symposium on applied computing (SAC); 2004.
4. Baumgrass A. Deriving current-state RBAC models from event logs. In: International workshop on security aspects of process-aware information systems (SAPAIS). Proc. of the 6th International conference on availability, reliability and security (ARES), IEEE Computer Society; 2011.
5. Baumgrass A, Schefer-Wenzl S, Strembeck M. Deriving process-related RBAC models from process execution histories. In: IEEE International workshop on security aspects of process and services engineering (SAPSE). In: Proc. of the 35th Annual IEEE International computer software and applications conference (COMPSAC); 2012.
6. Baumgrass A, Strembeck M. An approach to bridge the gap between role mining and role engineering via migration guides. In: Proc. of the 7th International conference on availability, reliability and security (ARES), IEEE Computer Security; 2012.
7. Baumgrass A, Strembeck M, Rinderle-Ma S. Deriving role engineering artifacts from business processes and scenario models. In: Proc. of the 16th ACM Symposium on access control models and technologies (SACMAT); 2011.
8. I. Benbasat, D. Goldstein, and M. Mead The case research strategy in studies of information systems MIS Quarterly 11 3 1987
9. E. Bertino, E. Ferrari, and V. Atluri The specification and enforcement of authorization constraints in workflow management systems ACM Transactions on Information and System Security (TISSEC) 2 1 1999
10. P.L. Bowen, R.A.O. Farrell, and F.H. Rohde An empirical investigation of end-user query development: the effects of improved model expressiveness vs. complexity Information Systems Research 20 4 2009
11. C. Brun, and A. Pierantonio Model differences in the eclipse modelling framework, UPGRADE The European Journal for the Informatics Professional IX 2 2008
12. A. Cavaye Case study research: a multi-faceted research approach for IS Information Systems Journal 6 3 2008
13. Chen Y, Douglis F, Huang H, Vo K. TopBlend: an efficient implementation of HtmlDiff in Java. In: Proc. of the World conference on the WWW and Internet (Web-Net); 2000.
14. A. Cicchetti, D. Di Ruscio, and A. Pierantonio A metamodel independent approach to difference representation Journal of Object Technology 6 9 2007
15. Cobéna G, Abiteboul S, Marian A. Detecting changes in XML documents. In: Proc. of the 18th International conference on data engineering (ICDE), IEEE Computer Society; 2002.
16. E. Coyne, and J. Davis Role engineering for enterprise security management 2008 Artech House
17. de Medeiros A, Günther CW. Process mining: using CPN tools to create test logs for mining algorithms. In: Proc. of the 6th Workshop and tutorial on practical use of coloured petri nets and the CPN tools; 2005.
18. J. des Riviéres, and J. Wiegand Eclipse: a platform for integrating development tools IBM Systems Journal 43 2 2004
19. M. Dumas, W. van der Aalst, and A. ter Hofstede Process-aware information systems 2005 John Wiley & Sons, Inc.
20. K. Eisenhardt Building theories from case study research The Academy of Management Review 14 4 1989
21. D. Ferraiolo, D. Kuhn, and R. Chandramouli Role-based access control 2nd ed. 2007 Artech House
22. Fisler K, Krishnamurthi S, Meyerovich LA, Tschantz MC. Verification and change-impact analysis of access-control policies. In: Proc. of the 27th International conference on software engineering (ICSE), ACM; 2005.
23. Frank M, Buhmann JM, Basin D. On the definition of role mining. In: Proc. of the 15th ACM Symposium on access control models and technologies (SACMAT); 2010.
24. Fuchs L, Meier S. The role mining process model. In: Proc. of the 6th International conference on availability, reliability and security (ARES), IEEE Computer Security; 2011.
25. Fuchs L, Müller. Automating periodic role-checks: a tool-based approach. In: Proc. Business Services: Konzepte, Technologien, Anwendungen. 9. Internationale Tagung Wirtschaftsinformatik; 2009.
26. Fuchs L, Preis A. BusiROLE: a model for integrating business roles into identity management. In: Proc. of the 5th International conference on trust, privacy, and security in digital business (TrustBus); 2008.
27. M. Gallaher, A. O'Connor, and B. Kropp The economic impact of role-based access control March 2002 National Institute of Standards & Technology (NIST) Planning Report 02-1
28. Giblin C, Graf M, Karjoth G, Wespi A, Molloy I, Lobo J, et al. Towards an integrated approach to role engineering. In: Proc. of the 3rd ACM Workshop on assurable and usable security configuration (SafeConfig); 2010.
29. C. Griffin Using EMF December 2002 available at http://www.eclipse.org/ articles/Article-Using%20EMF/using-emf.html retrieved on 2012-10-05
30. A.R. Hevner, S.T. March, J. Park, and S. Ram Design science in information systems research MIS Quarterly 28 1 2004
31. Hu J, Zhang Y, Li R. Towards automatic update of access control policy. In: Proc. of the 24th International conference on large installation system administration (LISA), USENIX Association; 2010.
32. Hu J, Zhang Y, Li R, Lu Z. Role updating for assignments. In: Proc. of the 15th ACM Symposium on access control models and technologies (SACMAT); 2010.
33. Irwin K, Yu T, Winsborough W. Enforcing security properties in task-based systems. In: Proc. of the 13th ACM Symposium on access control models and technologies (SACMAT); 2008.
34. K. Jensen, L. Kristensen, and L. Wells Coloured petri nets and CPN tools for modelling and validation of concurrent systems International Journal on Software Tools for Technology Transfer (STTT) 9 2007 (Special Section CPN 04/05)
35. Kim M, Notkin D. Discovering and representing systematic code changes. In: Proc. of the 31st ACM/IEEE International conference on software engineering, vol. 2 (ICSE); 2009.
36. B. Kitchenham, L. Pickard, and S. Pfleeger Case studies for method and tool evaluation IEEE Software 12 4 1995
37. Koch M, Mancini LV, Parisi-Presicce F. On the specification and evolution of access control policies. In: Proc. of the 6th ACM Symposium on access control models and technologies (SACMAT); 2001.
38. Kolovos D. Establishing correspondences between models with the Epsilon comparison language. In: Model driven architecture-foundations and applications (ECMDA-FA), Lecture notes in computer science (LNCS), vol. 5562, Springer-Verlag; 2009.
39. D.S. Kolovos, D.D. Ruscio, A. Pierantonio, and R.F. Paige Different models for model matching: an analysis of approaches to support model differencing ICSE workshop on comparison and versioning of software models 2009 IEEE Computer Society
40. Kolovski V, Hendler J, Parsia B. Analyzing web access control policies. In: Proc. of the 16th International conference on world wide web (WWW), ACM; 2007.
41. Kuhlmann M, Shohat D, Schimpf G. Role mining - revealing business roles for security administration using data mining technology. In: Proc. of the 7th ACM Symposium on access control models and technologies (SACMAT); 2003.
42. Kunz S, Evdokimov S, Fabian B, Stieger B, Strembeck M. Role-based access control for information federations in the industrial service sector. In: Proc. of the 18th European conference on information systems (ECIS); 2010.
43. D. Lin, P. Rao, E. Bertino, N. Li, and J. Lobo EXAM: a comprehensive environment for the analysis of access control policies International Journal of Information Security 9 2010
44. Lin D, Rao P, Bertino E, Lobo J. An approach to evaluate policy similarity. In: Proc. of the 12th ACM Symposium on access control models and technologies (SACMAT); 2007.
45. P. Mazzoleni, B. Crispo, S. Sivasubramanian, and E. Bertino XACML policy integration algorithms ACM Transactions on Information and System Security (TISSEC) 11 1 2008
46. Mendling J, Strembeck M, Stermsek G, Neumann G. An approach to Extract RBAC models from BPEL4WS processes. In: Proc. of the 13th IEEE International Workshops on enabling technologies: infrastructures for collaborative enterprises (WETICE); 2004.
47. T. Mens A state-of-the-art survey on software merging IEEE Transactions on Software Engineering 28 5 2002
48. G. Miller WordNet: a lexical database for English Communications of the ACM 38 11 1995
49. MOF 2.0/XMI Mapping specification, version 2.1.1 December 2007 The Object Management Group (OMG) available at http://www.omg.org/technology/documents/ formal/xmi.htm formal/2007-12-01
50. D.L. Moody The "physics" of notations: toward a scientific basis for constructing visual notations in software engineering IEEE Transactions on Software Engineering 35 6 2009
51. M.D. Myers, and M. Newman The qualitative interview in IS research: examining the craft Information and Organization 17 1 2007
52. A. O'Connor, and R.J. Loomis Economic analysis of role-based access control December 2010 National Institute of Standards and Technology (NIST) Final Report
53. S. Oh, and S. Park Task-role-based access control model Information Systems 28 6 2003
54. Ohst D, Welle M, Kelter U. Differences between versions of UML diagrams. In: Proc. of the 9th European Software Engineering and the 11th ACM SIGSOFT International symposium on foundations of software engineering (ESEC/FSE); 2003.
55. OMG Business process modeling notation (BPMN) May 2010 The Object Management Group available at http://www.omg.org/spec/BPMN/2.0/Beta2/, version 2.0-Beta 2, dtc/2010-06-04
56. E. Rahm, and P.A. Bernstein A survey of approaches to automatic schema matching The VLDB Journal 10 2001
57. H.A. Reijers, and J. Mendling A study into the factors that influence the understandability of business process models IEEE Transactions on Systems, Man, and Cybernetics - Part A 41 3 2011
58. Rembert AJ, Ellis CS. An initial approach to mining multiple perspectives of a business process. In: Proc. of the 5th Richard Tapia celebration of diversity in computing conference (TAPIA); 2009.
59. P. Runeson, and M. Höst Guidelines for conducting and reporting case study research in software engineering Empirical Software Engineering 14 2 2009
60. R. Sandhu, E. Coyne, H. Feinstein, and C. Youman Role-based access control models IEEE Computer 29 2 1996
61. Schefer S, Strembeck M, Mendling J, Baumgrass A. Detecting and resolving conflicts of mutual-exclusion and binding constraints in a business process context. In: Proc. of the 19th International conference on cooperative information systems (CoopIS), Lecture notes in computer science (LNCS), vol. 7044, Springer-Verlag; 2011.
62. Schipper A, Fuhrmann H, Hanxleden R.V. Visual comparison of graphical models. In: Proc. of the 14th IEEE International conference on engineering of complex computer systems (ICECCS), IEEE Computer Society; 2009.
63. Schlegelmilch J, Steffens U. Role mining with ORCA. In: Proc. of the 10th ACM Symposium on access control models and technologies (SACMAT); 2005.
64. Senat der Wirtschaftsuniversität Wien Anhang 6 Habilitationsrichtlinien des Senats May 2012 Satzung der Wirtschaftsuniversität Wien (WU) available at http://www.wu.ac.at/ structure/lobby/professorsassociation/habilrichtlinien-9.5.2012.pdf
65. S. Siegel Nonparametric statistics The American Statistician 11 3 1957
66. M. Song, and W. van der Aalst Towards comprehensive support for organizational mining Decision Support Systems 46 1 2008
67. D. Steinberg, F. Budinsky, M. Paternostro, and E. Merks EMF: eclipse modeling framework 2nd ed. 2008 Addison-Wesley Professional
68. S.S. Stevens On the theory of scales of measurement Science 103 2684 1946
69. Strembeck M. A role engineering tool for role-based access control. In: Proc. of the 3rd Symposium on requirements engineering for information security (SREIS); 2005.
70. M. Strembeck Scenario-driven role engineering IEEE Security & Privacy 8 1 January/February 2010
71. Strembeck M, Mendling J. Generic algorithms for consistency checking of mutual-exclusion and binding constraints in a business process context. In: Proc. of the 18th International conference on cooperative information systems (CoopIS), Lecture notes in computer science (LNCS), vol. 6426, Springer-Verlag; 2010.
72. M. Strembeck, and J. Mendling Modeling process-related RBAC models with extended UML activity models Information and Software Technology 53 5 2011
73. J. Sweller Cognitive load during problem solving: effects on learning Cognitive Science: A Multidisciplinary Journal 12 2 1988
74. Tan K, Crampton J, Gunter CA. The consistency of task-based authorization constraints in workflow systems. In: Proc. of the 17th IEEE Workshop on computer security foundations (CSFW); 2004.
75. Vaidya J, Atluri V, Guo Q, Adam N. Migrating to optimal RBAC with minimal perturbation. In: Proc. of the 13th ACM Symposium on access control models and technologies (SACMAT); 2008.
76. J. Vaidya, V. Atluri, J. Warner, and Q. Guo Role engineering via prioritized subset enumeration IEEE Transactions on Dependable and Secure Computing 7 3 2010
77. van den Brand M, Hofkamp A, Verhoeff T, Protić Z. Assessing the quality of model-comparison tools: a method and a benchmark data set. In: Proc. of the 2nd International workshop on model comparison in practice (IWMCP); 2011.
78. van den Brand M, Protić Z, Verhoeff T. Fine-grained metamodel-assisted model comparison. In: Proc. of the 1st International workshop on model comparison in practice (IWMCP), ACM; 2010.
79. W. van der Aalst, H.A. Reijers, and M. Song Discovering social networks from event logs Computer Supported Cooperative Work (CSCW) 14 6 2005 Springer-Verlag
80. J. Wainer, P. Barthelmess, and A. Kumar W-RBAC - a workflow security model incorporating controlled overriding of constraints International Journal of Cooperative Information Systems (IJCIS) 12 4 2003
81. Wang Y, DeWitt DJ, Cai J-Y. X-diff: an effective change detection algorithm for XML documents. In: Proc. of the 19th International conference on data engineering (ICDE), IEEE Computer Society; 2003.
82. Warner J, Atluri V. Inter-instance authorization constraints for secure workflow management. In: Proc. of the 11th ACM symposium on access control models and technologies (SACMAT); 2006.
83. Wenzel S. Scalable visualization of model differences. In: Proc. of the 2008 International workshop on comparison and versioning of software models (CVSM), ACM; 2008.
84. Williams JR, Kolovos DS, Polack FAC, Paige RF. Requirements for a model comparison language. In: Proc. of the 2nd International workshop on model comparison in practice (IWMCP), ACM; 2011.
85. Wolter C, Schaad A. Modeling of task-based authorization constraints in BPMN. In: Proc. of the 5th International conference on business process management (BPM), Lecture notes in computer science (LNCS), vol. 4714, Springer-Verlag; 2007.
86. Xing Z, Stroulia E. UMLDiff: an algorithm for object-oriented design differencing. In: Proc. of the 20th IEEE/ACM International conference on automated software engineering (ASE); 2005.
87. Zhang D, Ramamohanarao K, Ebringer T. Role engineering using graph optimisation. In: Proc. of the 12th ACM symposium on access control models and technologies (SACMAT); 2007.
88. Zhang D, Ramamohanarao K, Ebringer T, Yann T. Permission set mining: discovering practical and useful roles. In: Proc. of the 2008 annual computer security applications conference (ACSAC), IEEE Computer Society; 2008.