Towards a Business Process-Driven Framework for Security Engineering with the UML

Abstract

Abstract.A challenging task in security engineering concerns the specification and integration of security with other requirements at the top level of requirements engineering. Empirical studies show that it is commonly at the business process level that customers and end users are able to express their security needs. In addition, systems are often developed by automating existing manual business processes. Since many security notions belongs conceptually to the world of business processes, it is natural to try to capture and express them in the context of business models in which moreover customers and end users feel most comfortable. In this paper, based on experience drawn from an ongoing work within the CASENET project [1], we propose a UML-based business process-driven framework for the development of security-critical systems.

Information flow property preserving transformation of UML interaction diagrams

“…Other efforts that are comparable to ours on a general level in that they address security in an MDA-setting and/or model-based security, can be roughly classified into (1) access control related works: [2,4,7,8,9,18,23,24,28,29], (2) secure database development [10], and (3) specification of high-level security requirements [1,6,11,32]. Although all these works are comparable to ours on a general level, they are in fact quite different in that they do not deal with a formalized notion of refinement, nor do they address information flow security.…”

Usability of Security Specification Approaches for UML Design: A Survey.

“…Vivas et al propose an approach for the development of business process-driven systems where security requirements are integrated into the business model [28]. Security requirements are first stated at the high level of abstraction within a functional representation of the system given by UML diagrams using tagged values.…”

“…Many contributions have been presented in the state of the art for specifying and enforcing security at UML design [1,2,4,5,6,7,8,14,16,17,18,19,20,22,23,27,28,30]. While sharing almost the same objectives, these contributions Cite this document as follows: http://www.jot.fm/general/JOT template LaTeX.tgz * The research leading to this work was possible due to funding and scientific collaboration with Software Research, Ericsson Canada.…”

Semi-formal transformation of secure business processes into analysis class and use case models: An MDA approach

“…Works related to business process security [6,27,28,39,59,60,64,67] have contributed interesting ideas, but most of the cases do not make it possible to model security needs together with the standard languages for modelling businesses process. Nor do they offer continuity and traceability of these requirements in the rest of the software development process.…”