Validation of IS Security Policies featuring Authorisation Constraints - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Article Dans Une Revue International Journal of Information System Modeling and Design Année : 2015

Validation of IS Security Policies featuring Authorisation Constraints

Jérémy Milhau
  • Fonction : Auteur
  • PersonId : 765742
  • IdRef : 158798570
Muhammad Nafees Qamar
  • Fonction : Auteur
Régine Laleau
Mohamed-Amine Labiadh
  • Fonction : Auteur

Résumé

Designing a security policy for an information system (IS) is a non-trivial task. Variants of the RBAC model can be used to express such policies as access-control rules associated to constraints. In this paper, we advocate that currently available tools do not take sufficiently into account the functional description of the application and its impact on authorisation constraints and dynamic aspects of security. We suggest translating both security and functional models into a formal language, such as B, whose analysis and animation tools will help validate a larger set of security scenarios. We describe how various kinds of constraints can be expressed and animated in this context. We also present a tool support which performs this translation and report on a case study where animation and testing techniques were used to validate the security policy of a medical emergency information system.

Domaines

Informatique
Fichier non déposé

Dates et versions

hal-00976108 , version 1 (09-04-2014)

Identifiants

  • HAL Id : hal-00976108 , version 1

Citer

Yves Ledru, Akram Idani, Jérémy Milhau, Muhammad Nafees Qamar, Régine Laleau, et al.. Validation of IS Security Policies featuring Authorisation Constraints. International Journal of Information System Modeling and Design, 2015, 6 (1), pp.24-46. ⟨hal-00976108⟩
158 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More