ABAC Requirements Engineering for Database Applications

Jim Longstaff, Mengda He

Research output: Contribution to conferencePaper

32 Downloads (Pure)

Abstract

We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.
Original languageEnglish
Publication statusPublished - 29 Jul 2019
EventThe 13th International Symposium on Theoretical Aspects of Software Engineering - Guilin, China
Duration: 29 Jul 20191 Aug 2019
http://www.se.gxnu.edu.cn/tase2019/

Conference

ConferenceThe 13th International Symposium on Theoretical Aspects of Software Engineering
CountryChina
CityGuilin
Period29/07/191/08/19
Internet address

Fingerprint

Requirements engineering
Access control
Glass
Processing

Cite this

Longstaff, J., & He, M. (2019). ABAC Requirements Engineering for Database Applications. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, Guilin, China.
Longstaff, Jim ; He, Mengda. / ABAC Requirements Engineering for Database Applications. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, Guilin, China.
@conference{4dfda88f89cb4992acb91b1491c060c2,
title = "ABAC Requirements Engineering for Database Applications",
abstract = "We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.",
author = "Jim Longstaff and Mengda He",
year = "2019",
month = "7",
day = "29",
language = "English",
note = "The 13th International Symposium on Theoretical Aspects of Software Engineering ; Conference date: 29-07-2019 Through 01-08-2019",
url = "http://www.se.gxnu.edu.cn/tase2019/",

}

Longstaff, J & He, M 2019, 'ABAC Requirements Engineering for Database Applications' Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, Guilin, China, 29/07/19 - 1/08/19, .

ABAC Requirements Engineering for Database Applications. / Longstaff, Jim; He, Mengda.

2019. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, Guilin, China.

Research output: Contribution to conferencePaper

TY - CONF

T1 - ABAC Requirements Engineering for Database Applications

AU - Longstaff, Jim

AU - He, Mengda

PY - 2019/7/29

Y1 - 2019/7/29

N2 - We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.

AB - We show how complex privacy requirements can be represented and processed by an extended model of Attribute Based Access Control (ABAC), working with a simple database applications pattern. During application model development, most likely based on UML (e.g. Use Case, Class Diagrams), the analyst and possibly the end user specifies ABAC permissions, and then verifies their effect by running queries on the target data. The ABAC model supports positive and negative permissions, “break glass” overrides of negative permissions, and message/alert generation. The permissions combining algorithms are based on relational database optimisation, and permissions processing is implemented by query modification, producing structurally-optimised queries in an SQL-like language; the queries can then be processed by many database and big data systems. The method and models have been implemented in a prototype Privacy Preferences Tool in collaboration with a large medical records development, and we discuss experiences with focus group evaluations of this tool.

M3 - Paper

ER -

Longstaff J, He M. ABAC Requirements Engineering for Database Applications. 2019. Paper presented at The 13th International Symposium on Theoretical Aspects of Software Engineering, Guilin, China.