ABAC Requirements Engineering for Database Applications

Research output: Contribution to conferencePaperResearchpeer-review

10 Downloads (Pure)

Abstract

We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.
Original languageEnglish
Publication statusPublished - 2019
EventThe 13th International Symposium on Theoretical Aspects of Software Engineering -
Duration: 29 Jul 201929 Jul 2019

Conference

ConferenceThe 13th International Symposium on Theoretical Aspects of Software Engineering
Period29/07/1929/07/19

Fingerprint

Requirements engineering
Access control
Glass
Processing

Cite this

Longstaff, J., & He, M. (2019). ABAC Requirements Engineering for Database Applications. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, .
Longstaff, Jim ; He, Mengda. / ABAC Requirements Engineering for Database Applications. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, .
@conference{4dfda88f89cb4992acb91b1491c060c2,
title = "ABAC Requirements Engineering for Database Applications",
abstract = "We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.",
author = "Jim Longstaff and Mengda He",
year = "2019",
language = "English",
note = "The 13th International Symposium on Theoretical Aspects of Software Engineering ; Conference date: 29-07-2019 Through 29-07-2019",

}

Longstaff, J & He, M 2019, 'ABAC Requirements Engineering for Database Applications' Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, 29/07/19 - 29/07/19, .

ABAC Requirements Engineering for Database Applications. / Longstaff, Jim; He, Mengda.

2019. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, .

Research output: Contribution to conferencePaperResearchpeer-review

TY - CONF

T1 - ABAC Requirements Engineering for Database Applications

AU - Longstaff, Jim

AU - He, Mengda

PY - 2019

Y1 - 2019

N2 - We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.

AB - We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.

M3 - Paper

ER -

Longstaff J, He M. ABAC Requirements Engineering for Database Applications. 2019. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, .