Requirements engineering for trust management: model, methodology, and reasoning

  • Authors:

  • Paolo Giorgini;Fabio Massacci;John Mylopoulos;Nicola Zannone

  • Affiliations:

  • Department of Information and Communication Technology, University of Trento, Trento, Italy;Department of Information and Communication Technology, University of Trento, Trento, Italy;Department of Information and Communication Technology, University of Trento, Trento, Italy;Department of Information and Communication Technology, University of Trento, Trento, Italy

  • Venue:
  • International Journal of Information Security
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

A number of recent proposals aim to incorporate security engineering into mainstream software engineering. Yet, capturing trust and security requirements at an organizational level, as opposed to an IT system level, and mapping these into security and trust management policies is still an open problem. This paper proposes a set of concepts founded on the notions of ownership, permission, and trust and intended for requirements modeling. It also extends Tropos, an agent-oriented software engineering methodology, to support security requirements engineering. These concepts are formalized and are shown to support the automatic verification of security and trust requirements using Datalog. To make the discussion more concrete, we illustrate the proposal with a Health Care case study.