1 / 8

Using UML and Alloy to Specify and Analyze Access Control Features

Using UML and Alloy to Specify and Analyze Access Control Features. Eunjee Song, Xi Hua SP05-CS681 Project Proposal. Motivation 1. Access Control feature as a cross cutting aspect => An A spect Oriented Modeling (AOM) approach for secure system Crosscutting features

cai
Download Presentation

Using UML and Alloy to Specify and Analyze Access Control Features

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Using UML and Alloy to Specify and Analyze Access Control Features Eunjee Song, Xi Hua SP05-CS681 Project Proposal

  2. Motivation 1 • Access Control feature as a cross cutting aspect => An Aspect Oriented Modeling (AOM) approach for secure system • Crosscutting features • Need composition (aspect + application) • Complicate analysis tasks => must to be modeled using a formal and analyzable notation.

  3. Motivation 2 • Two types of access control features can be composed. e.g., RBAC + MAC => Hybrid Access Control (HAC) • How can we analyze the composed model and show whether the desired properties still hold or not?  Is an access “denied either in RBAC or in MAC” or “denied in both models” denied in HAC?

  4. “Analyzable” Specification Languages • which language should be chosen? • Z • UML/OCL • Alloy

  5. Z vs. OCL • Z/Object Z • A formal specification language based on math concepts (sets, functions, and first-order predicate logic) • No support on visualization • OCL (Object Constraint Language) • An object oriented specification language designed to support specifications in UML • Questionable analysis power of currently available tools (e.g., USE, ArgoUML)

  6. Alloy • Developed by Dr. Daniel Jackson at MIT • Lightweight modeling and analysis tool • Relatively easy to understand and use • Convenient Analysis capability by Alloy Analyzer • Compared to OCL… • similar to OCL • more conventional syntax & simpler semantics • fully declarative => automatic analysis

  7. Research Goal • Analysis on RBAC, MAC, and HAC in Alloy • Any mapping rules from UML/OCL to Alloy? • Any errors found in UML/OCL models? • Any design changes influenced by using Alloy? • Evaluation on the usefulness of Alloy Analyzer as an analysis engine for the verifiable model composition.

  8. Work Plan • TranslateUML Models to Alloy specifications with analysis : 02/27/05-03/26/05 • RBAC, MAC, and HAC • Experiment with Alloy Analyzer: Analyze models and modify them if required. • Mapping rules from OCL to Alloy. • Analyze the experiment result : 03/27/05-04/01/05 • Refine mapping rules, if required. • Derive further works for the verifiable model composition • Complete Write-up

More Related