Object-oriented software construction (2nd ed.)
Object-oriented software construction (2nd ed.)
Specification and proof in membership equational logic
Theoretical Computer Science - Trees in algebra and programming
ECOOP '01 Proceedings of the 15th European Conference on Object-Oriented Programming
Security Through Aspect-Oriented Programming
Proceedings of the IFIP TC11 WG11.4 First Annual Working Conference on Network Security: Advances in Network and Distributed Systems Security
Model driven security: From UML models to access control infrastructures
ACM Transactions on Software Engineering and Methodology (TOSEM)
Role-Based Access Control, Second Edition
Role-Based Access Control, Second Edition
Towards an automated test generation for the verification of model transformations
Proceedings of the 2007 ACM symposium on Applied computing
Model-Driven Security in Practice: An Industrial Experience
ECMDA-FA '08 Proceedings of the 4th European conference on Model Driven Architecture: Foundations and Applications
Automated analysis of security-design models
Information and Software Technology
Automated analysis of permission-based security using UMLsec
FASE'08/ETAPS'08 Proceedings of the Theory and practice of software, 11th international conference on Fundamental approaches to software engineering
All about maude - a high-performance logical framework: how to specify, program and verify systems in rewriting logic
Secure Systems Development with UML
Secure Systems Development with UML
Model transformations? transformation models!
MoDELS'06 Proceedings of the 9th international conference on Model Driven Engineering Languages and Systems
Model-based security engineering with UML: introducing security aspects
FMCO'05 Proceedings of the 4th international conference on Formal Methods for Components and Objects
An aspect-oriented approach to declarative access control for web applications
APWeb'06 Proceedings of the 8th Asia-Pacific Web conference on Frontiers of WWW Research and Development
Dynamic secure aspect modeling with UML: from models to code
MoDELS'05 Proceedings of the 8th international conference on Model Driven Engineering Languages and Systems
A formal enforcement framework for role-based access control using aspect-oriented programming
MoDELS'05 Proceedings of the 8th international conference on Model Driven Engineering Languages and Systems
ITP/OCL: a rewriting-based validation tool for UML+OCL static class diagrams
AMAST'06 Proceedings of the 11th international conference on Algebraic Methodology and Software Technology
SBMF'11 Proceedings of the 14th Brazilian conference on Formal Methods: foundations and Applications
Enforcement of entailment constraints in distributed service-based business processes
Information and Software Technology
| Hi-index | 0.00 |
Access control is an important security issue. It has been addressed since the late 1960s in the early time-sharing computer systems. Many access control models have been proposed since than but of particular interest is Ferraiolo and Khun's role-based access control model (RBAC). It is a simple and yet general model which has been deeply studied and applied both in industry and in academia. A variety of industrial standards have been proposed based on this model. Generating code for an access control policy is an interesting challenge. Understanding access control as a non-functional concern that cross-cuts the functional part of a system raises difficulties quite suitable for a solution based on aspect-oriented programming. In this paper, we address the problems of specification and validation of code generation for access control policies targeting an aspect-based infra-structure. We propose an MDA approach. The code generator is a transformation from SecureUML, an RBAC-based modeling language, to the language Aspects for Access Control (AAC), an aspect-oriented modeling language proposed in this paper. Metamodels are used to represent the languages and to specify the transformation. A metamodel is used to represent the abstract syntax of a language and the constraints that a given instance model of the metamodel must fulfill. We also use a metamodel to specify the code generator. This transformation metamodel, together with all the constraints, that is, from both languages and those constraints regarding the merge of the two languages, we call a transformation contract. It merges and conservatively extends the source and target metamodels of the model transformation it represents. In the context of code-generation for access control policies, the transformation contract specifies the relationships between the abstract syntaxes of SecureUML and AAC and constrains the two languages. The validation of the code generator also uses the transformation contract. For a given access control policy and aspect, represented as instances of the appropriate metamodels, with aspects produced by the code generator, the constraints of the transformation contract must hold. We have prototyped a transformer from SecureUML to aspects on top of ITP/OCL, an OCL interpreter that automatically validates the generated aspect code by applying the constraints of the transformation contract.