Validating the enforcement of access control policies and separation of duty principle in requirement engineering

  • Authors:

  • Khaled Alghathbar

  • Affiliations:

  • King Saud University, College of Computer and Information Sciences, P.O. Box 51178, Riyadh 11543, Saudi Arabia

  • Venue:
  • Information and Software Technology
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Validating the compliance of software requirements with the access control policies during the early development life cycle improves the security of the software. It prevents authorizing unauthorized subject during the specification of requirements and analysis before proceeding to other phases where the cost of fixing defects is augmented. This paper provides a logical-based framework that analyzes the authorization requirements specified in the Unified Modeling Language (UML). It ensures that the access requirements are consistent, complete and conflict-free. The framework proposed in this paper is an extension to AuthUML framework. We refine AuthUML and extend it by expanding its analysis to validate the enforcement of the Separation of Duty (SoD) during the requirement engineering. We enhance and extend AuthUML with the necessary phase, predicates and rules. The paper shows the various types of SoD and how each type can be validated. The extension shows the flexibility and scalability of AuthUML to validate new policies. Also, the extension makes AuthUML spans to different phases of the software development process that widen the application of AuthUML.