ABSTRACT
Security must be a first class citizen in the design of large scale, interacting, software applications, at early and all stages of the lifecycle, for accurate and precise policy definition, authorization, authentication, enforcement, and assurance. One of the dominant players in software design is the <i>unified modeling language, UML,</i> a language for specifying, visualizing, constructing and documenting software artifacts. In UML, diagrams provide alternate perspectives for different stakeholders, e.g.: <i>use case diagrams</i> for the interaction of users with system components, class diagrams for the static classes and relationships among them, and <i>sequence diagrams</i> for the dynamic behavior of instances of the class diagram. However, UML's support for the definition of security requirements for these diagrams and their constituent elements (e.g., actors, systems, use cases, classes, instances, include/extend/generalize relationships, methods, data, etc.) is lacking. In this paper, we address this issue by incorporating <i>mandatory access control (MAC)</i> into use case, class, and sequence diagrams, providing support for the definition of clearances and classifications for relevant UML elements. In addition, we provide a framework for security assurance as users are defining and evolving use case, class, and sequence diagrams, bridging the gap between software engineers and an organization's security personnel in support of <i>secure software design</i>. To demonstrate the feasibility and utility of our work on secure software design, our MAC enhancements for UML have been integrated into Borland's Together Control Center Environment.
- Alghathbar, K. and Wijesekera, D. AuthUML: A Three-phased Framework to model Secure Use Cases. In Proc. of the Formal Methods in Security Engineering Wksp (FMSE'03), Washington D.C., USA, 2003. Google ScholarDigital Library
- Alghathbar, K. and Wijesekera, D. Consistent and Complete Access Control Policies in Use Cases. In Proc. of UML 2003, San Francisco, CA, LNCS, 2003.Google ScholarCross Ref
- Bell, D. and La Padula, L. Secure Computer Systems: Mathematical Foundations Model. M74-244, Mitre Corp., 1975.Google Scholar
- Biba, K. Integrity Considerations for Secure Computer Systems. TR-3153, Mitre Corp., 1977.Google Scholar
- Booch, G. Object-Oriented Design With Applications. Benjamin/Cummings, 1991. Google ScholarDigital Library
- Booch G., et al. The Unified Modeling Language User Guide. Addison Wesley, 1999. Google ScholarDigital Library
- Budd, T. An Introduction to Object-Oriented Programming. Addison-Wesley, 1997. Google ScholarDigital Library
- Cormen, T., et al. Introduction to Algorithms. The MIT Press and McGraw-Hill, 1990. Google ScholarDigital Library
- Doan, T., et al. RBAC/MAC Security for UML. In Proc. of the 18th Annual IFIP WG 11.3 Working Conference on Data and Applications Security. Sitges, Spain, July, 2004.Google Scholar
- http://www.engr.uconn.edu/ steve/DSEC/dsec.html.Google Scholar
- Epstein, P. and Sandhu, R. Towards A UML Based Approach to Role Engineering. In Proc. of the 4th ACM workshop on Role-based Access Control, 1999. Google ScholarDigital Library
- Ferraiolo, D., et al. Proposed NIST Standard for Role-Based Access Control. ACM Trans. on Information and System Security, Vol. 4, No. 3. August 2001. Google ScholarDigital Library
- Gurevich, Y. Evolving algebras 1993: Lipari guide. In E. Borger, editor, Specification and Validation Methods. Oxford University Press, 1995. Google ScholarDigital Library
- Jacobson, I., et al. Object-Oriented Software Engineering: A Use Case Driven Approach. Addison-Wesley, 1992. Google Scholar
- Jürjens, J. Principles for Secure Systems Design. Ph.D. dissertation. Oxford University Computing Laboratory. Oxford University, 2002.Google Scholar
- Jürjens, J. UMLsec: Extending UML for Secure Systems Development. In Proc. of UML 2002, LNCS, Sept. 30 - Oct. 4, 2002.Google Scholar
- Lodderstedt, T., et al. SecureUML: A UML-Based Modeling Language for Model-Driven Security. In Proc. of UML 2002, LNCS, 2002. Google ScholarDigital Library
- OMG. Unified Modeling Language, v.1.5. UML Resource Page. http://www.omg.org/uml/Google Scholar
- Osborn, S., et al. Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies. ACM Trans. on Information and System Security. Vol. 3, No. 2, May 2000. Google ScholarDigital Library
- Osborn, S. Information Flow Analysis of an RBAC System. In Proc. of SACMAT'02, June, 2002. Google ScholarDigital Library
- Phillips, C., et al. Security Assurance for an RBAC/MAC Security Model. In Proc. of the 2003 IEEE Info. Assurance Wksp., 2003.Google ScholarCross Ref
- Ray, I., et al. Using Parameterized UML to Specify and Compose Access Control Models. In Proc. of the 6th IFIP Working Conference on Integrity & Internal Control in Info. Systems, 2003.Google Scholar
- Rumbaugh, J., et al. Object-Oriented Modeling and Design. Prentice-Hall, 1991. Google ScholarDigital Library
- Shin, M. and Ahn, G. UML-Based Representation of Role-Based Access Control. In Proc. of the IEEE 9th Intl. Wksp. on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2000. Google ScholarDigital Library
- Thuraisingham, B. Mandatory Security in Object-Oriented Database Systems. In Proc. of 1989 OOPSLA Conf., 1989. Google ScholarDigital Library
- Zdonik, S. and Maier, D. Fundamentals of Object-Oriented Databases, in Readings in Object-Oriented Database Systems, S. Zdonik and D. Maier (eds.), Morgan Kaufmann, 1990. Google ScholarDigital Library
Index Terms
MAC and UML for secure software design
Recommendations
Integrating Access Control into UML for Secure Software Modeling and Analysis
Access control models are often an orthogonal activity when designing, implementing, and deploying software applications. Role-based access control RBAC which targets privileges based on responsibilities within an application and mandatory access ...
Tools for secure systems development with UML
For model-based development to be a success in practice, it needs to have a convincing added-value associated with its use. Our goal is to provide such added-value by developing tool-support for the analysis of UML models against difficult system ...
Meta Model Approach for Mediation
COMPSAC '03: Proceedings of the 27th Annual International Conference on Computer Software and ApplicationsIn this work, we discuss how to interpret traditionalData Flow Diagram (DFD) by Unified Modeling Language(UML) for the purpose of integrating legacy systems withmodern systems. To do that we introduce DFD meta modelby using UML class diagrams and Object ...
Comments