Incorporating Access Control Policies in Requirements Engineering

Abstract

To improve software security, security requirements must be considered along with functional requirements during the early development life cycle. Systematic development of security sensitive software requires that there be a sufficiently expressive linguistic extension to model them. We propose an extension to the Unified Modeling Language (UML) to satisfy this need. We extend the UML metamodel with a security policy constraint specification and enforcement module, business tasks and a history log for method calls. Using these extensions we show how dynamic access control requirements of an application can be modeled during the design phase.