TY - JOUR
T1 - Constructing authorization systems using assurance management framework
AU - Hu, Hongxin
AU - Ahn, Gail-Joon
N1 - Funding Information:
Manuscript received June 8, 2009; revised November 27, 2009 and February 26, 2010; accepted March 30, 2010. Date of publication May 10, 2010; date of current version June 16, 2010. This paper was recommended by Associate Editor E. R. Weippl. This work was supported in part by the National Science Foundation under Grant NSF-IIS-0242393, Grant NSF-IIS-0900970, and Grant NSF-CNS-0831360 and in part by the Department of Energy Early Career Principal Investigator Award under Grant DE-FG02-03ER25565.
PY - 2010/7
Y1 - 2010/7
N2 - Model-driven approach has recently received much attention in developing secure software and systems. In addition, software developers have attempted to employ such an emerging approach in the early stage of software development life cycle. However, security concerns are rarely considered and practiced due to the lack of appropriate systematic mechanisms and tools. In this paper, we introduce a multilayered software development life cycle (SDLC), which is based on an assurance management framework (AMF), focusing on the development of authorization systems. AMF facilitates comprehensive realization of formal security model, security policy specification and verification, generation of security enforcement codes, and rigorous conformance testing. We also articulate our experience in analyzing role-based authorization requirements and realizing those requirements in constructing a role-based authorization system.
AB - Model-driven approach has recently received much attention in developing secure software and systems. In addition, software developers have attempted to employ such an emerging approach in the early stage of software development life cycle. However, security concerns are rarely considered and practiced due to the lack of appropriate systematic mechanisms and tools. In this paper, we introduce a multilayered software development life cycle (SDLC), which is based on an assurance management framework (AMF), focusing on the development of authorization systems. AMF facilitates comprehensive realization of formal security model, security policy specification and verification, generation of security enforcement codes, and rigorous conformance testing. We also articulate our experience in analyzing role-based authorization requirements and realizing those requirements in constructing a role-based authorization system.
KW - Authorization
KW - model-driven approach
KW - role based
KW - unified modeling language (UML)
UR - http://www.scopus.com/inward/record.url?scp=77953712128&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=77953712128&partnerID=8YFLogxK
U2 - 10.1109/TSMCC.2010.2047856
DO - 10.1109/TSMCC.2010.2047856
M3 - Article
AN - SCOPUS:77953712128
VL - 40
SP - 396
EP - 405
JO - IEEE Transactions on Systems, Man and Cybernetics Part C: Applications and Reviews
JF - IEEE Transactions on Systems, Man and Cybernetics Part C: Applications and Reviews
SN - 1094-6977
IS - 4
M1 - 5462923
ER -