1. Using UML and Alloy to Specify and Analyze Access Control Features Eunjee Song, Xi Hua SP05-CS681 Project Proposal

2. Motivation 1  Access Control feature as a cross cutting aspect => An Aspect Oriented Modeling (AOM) approach for secure system  Crosscutting features Need composition (aspect + application) Complicate analysis tasks => must to be modeled using a formal and analyzable notation.

3. Motivation 2  Two types of access control features can be composed. e.g., RBAC + MAC => Hybrid Access Control (HAC)  How can we analyze the composed model and show whether the desired properties still hold or not?  Is an access “ denied either in RBAC or in MAC ” or “ denied in both models ” denied in HAC?

4. “ Analyzable ” Specification Languages  which language should be chosen? Z UML/OCL Alloy

5. Z vs. OCL  Z/Object Z A formal specification language based on math concepts (sets, functions, and first- order predicate logic) No support on visualization  OCL (Object Constraint Language) An object oriented specification language designed to support specifications in UML Questionable analysis power of currently available tools (e.g., USE, ArgoUML)

6. Alloy  Developed by Dr. Daniel Jackson at MIT  Lightweight modeling and analysis tool  Relatively easy to understand and use  Convenient Analysis capability by Alloy Analyzer  Compared to OCL … similar to OCL more conventional syntax & simpler semantics fully declarative => automatic analysis

7. Research Goal  Analysis on RBAC, MAC, and HAC in Alloy Any mapping rules from UML/OCL to Alloy? Any errors found in UML/OCL models? Any design changes influenced by using Alloy?  Evaluation on the usefulness of Alloy Analyzer as an analysis engine for the verifiable model composition.

8. Work Plan  Translate UML Models to Alloy specifications with analysis : 02/27/05-03/26/05 RBAC, MAC, and HAC Experiment with Alloy Analyzer: Analyze models and modify them if required. Mapping rules from OCL to Alloy.  Analyze the experiment result : 03/27/05-04/01/05 Refine mapping rules, if required. Derive further works for the verifiable model composition  Complete Write-up