Enforcing fine-grained access control for secure collaborative modelling using bidirectional transformations

Abstract

Large-scale model-driven system engineering projects are carried out collaboratively. Engineering artefacts stored in model repositories are developed in either offline (checkout-modify-commit) or online (GoogleDocstyle) scenarios. Complex systems frequently integrate models and components developed by different teams, vendors and suppliers. Thus, confidentiality and integrity of design artefacts need to be protected in accordance with access control policies. We propose a secure collaborative modelling approach where fine-grained access control for models is strictly enforced by bidirectional model transformations. Collaborators obtain filtered local copies of the model containing only those model elements which they are allowed to read; write access control policies are checked on the server upon submitting model changes. We present a formal collaboration schema which provenly guarantees certain correctness constraints, and its adaption to online scenarios with on-the-fly change propagation and the integration into existing version control systems to support offline scenarios. The approach is illustrated, and its scalability is evaluated using a case study of the MONDO EU project.

Diversity of graph models and graph generators in mutation testing

“…Erroneous access control settings can have a critical impact [27], due to export control regulations, the high business value of intellectual property (IP) contained in the models, and the importance of adherence to change request procedures. However, in practice, it may be difficult to properly implement access control policies based on informal security requirements (see examples in [8,18,23]) and the interactions or conflicts between different access rules or requirements may not be well thought-out. An example access rule may grant certain specialists full access to subsystems they own, as well as the contents of such subsystems.…”

“…In our experiments, we rely on the policy language of the MONDO Collaboration Framework [18], which is (i) fine-grained in the sense that each model element is assigned its own set of permissions; and (ii) rule-based with single rules granting or denying permissions for many elements in a model (selected according to an expressive graph query / predicate, see Sect. 2.3).…”

“…This paper extends previous work [50] by incorporating novel distance metrics, a new complex case study, and a substantially extended experimental evaluation (with new research questions, model generators and a new case study). Finally, as a by-product, we also provide a reusable mutation generator (following ideas in [10,35]) for a model-based access control policy language [18].…”

Controllable and decomposable multidirectional synchronizations

“…However, they offer access control with very specific limitations, at least by default. More sophisticated access control solutions exist [9], but the interactions of multiple views are poorly studied, despite the potential for unintended side effects. We believe that a significant reason for the lack of satisfying solutions is that the underlying mathematics is not sufficiently understood at this point, making it difficult to engineer collaboration platforms that work both correctly and predictably, while still keeping a large degree of freedom in the kind of access control policies that can be applied.…”

Scalable modeling technologies in the wild: an experience report on wind turbines control applications development

“…The central component of the MONDO Collaboration Framework is the MONDO Collaboration Server [10], which enforces fine-grained access control during both offline and online collaborative modeling. The server provides secure views with precisely defined model access to each collaborator, synchronized with each other by bidirectional model transformations [25]. In particular, a transformation applies read access restrictions to present a filtered view to a user, while a separate transformation merges changes proposed by a user into the unfiltered model (if write access restrictions allow); both transformations are automatically derived from the declared access control policy.…”