A Model-Driven Security Requirements Approach to Deduce Security Policies Based on OrBAC

Denisse Muñante Arzapalo , Vanea Chiprianov (1, 2, 3) , Laurent Gallon (3) , Philippe Aniorte (3)

1 Lab-STICC_TB_CID_IHSEV
2 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
3 LIUPPA - Laboratoire Informatique de l'Université de Pau et des Pays de l'Adour

Attacks on unsecured systems result in important loses. Many of the causes are related to non-conformance of system architecture and implementation to the requirements. To reduce these conformity problems, Model Driven Engineering proposes using modelling languages for defining requirements and architecture and model transformations between them. We therefore introduce a modelling language extension/ profile for defining system requirements with basic security requirement concepts. We also formalize the model transformation between this profile and a security formal verification method. We exemplify our approach on a medical case study. \textcopyright Springer International Publishing Switzerland 2015.

Domains: Computer Science [cs]

Denisse Muñante Arzapalo, Vanea Chiprianov, Laurent Gallon, Philippe Aniorte. A Model-Driven Security Requirements Approach to Deduce Security Policies Based on OrBAC. Information Security and Cryptology - 10th International Conference, Inscrypt 2014, Beijing, China, December 13-15, 2014, Revised Selected Papers, Dec 2014, Beijing, China. pp.150--169, ⟨10.1007/978-3-319-16745-9_9⟩. ⟨hal-01908073⟩