Your browser does not support JavaScript!
http://iet.metastore.ingenta.com
1887

Language-based access control approach for component-based software applications

Language-based access control approach for component-based software applications

For access to this article, please select a purchase option:

Buy article PDF
$19.95
(plus tax if applicable)
Add to cart
Buy Knowledge Pack
10 articles for $120.00
(plus taxes if applicable)
Add to cart

IET members benefit from discounts to all IET publications and free access to E&T Magazine. If you are an IET member, log in to your account and the discounts will automatically be applied.

Learn more about IET membership 

Recommend Title Publication to library

You must fill out fields marked with: *

Librarian details
Name:*
Email:*
Your details
Name:*
Email:*
Department:*
Why are you recommending this title?
Select reason:
 
 
 
 
 
IET Software — Recommend this title to your library

Thank you

Your recommendation has been sent to your librarian.

© The Institution of Engineering and Technology
Published

Security in component-based software applications is studied by looking at information leakage from one component to another through operation calls. Components and security specifications about confidentiality as regular languages are modelled. Then a systematic way is provided to synthesise an access control mechanism, which not only guarantees all specifications to be obeyed, but also allows each user to attain maximum permissive behaviours.

Inspec keywords: access control; object-oriented programming

Other keywords: component-based software applications; security specification; access control mechanism; language-based access control; maximum permissive behaviours; information leakage

Subjects: Object-oriented programming; Computer installation management

References

    1. 1)
    2. 2)
      • D. Spinellis , D. Gritzalis . Panoptis: intrusion detection using a domain-specific language. J. Comput. Security , 159 - 176
    3. 3)
      • Robocop: robust open component-based software architecture: URL http:\\www.hitech-projects.com\euprojects\robocop\deliverables.htm.
    4. 4)
      • P. Inverardi , L. Mostarda . (2005) A distributed intrusion detection approach for security software architecture, Lecture Notes in Computer Science 3527.
    5. 5)
    6. 6)
      • M. Tivoli , M. Autili . SYNTHESIS, a tool for synthesizing correct and protocol-enhanced adaptors. RSTI L'Objet J. , 1 , 77 - 103
    7. 7)
      • E.M. Clarke , O. Grumberg . (1999) Model checking.
    8. 8)
      • B. Lampson , M. Abadi , M. Burrows , E. Wobber . Authentication in distributed systems: theory and practice. ACM Trans. Comput. Syst. (TOCS) , 4 , 265 - 310
    9. 9)
      • S.T. Eckmann , G. Vigna , R.A. Kemmerer . STATL: an attack language for state-based intrusion detection. J. Comput. Security , 71 - 103
    10. 10)
      • P. Inverardi , M. Tivoli . (2003) Software architecture for correct components assembly, in Formal Methods for the Design of Computer, Communication and Software Systems: Software Architecture.
    11. 11)
      • Banerjee, A., Naumann, D.A.: `History-based access control and secure information flow', In Proc. Workshop on Construction and Analysis of Safe, Secure and Interoperable Smart Cards (CASSIS), 8–11 March 2005, Nice, France, p. 27–48.
    12. 12)
      • Li, H., Zhang, X., Wu, H., Qu, Y.: `Design and application of rule based access control policies', Semantic Web and Policy Workshop, 4th Int. Semantic Web Conf., 7 November 2005, Galway, Ireland.
    13. 13)
      • Edjlali, G., Acharya, A., Chaudhary, V.: `History-based access control for mobile code', 5thACM Conf. Comput. Communications Security, 1998, San Francisco, CA, USA, p. 38–48.
    14. 14)
    15. 15)
      • W.M. Wonham . (2004) Supervisory Control of Discrete-Event Systems.
    16. 16)
      • R.S. Sandhu . Lattice-based access control models. IEEE Comput. , 11 , 9 - 19
    17. 17)
      • D.F. Ferraiolo , D.R. Kuhn , R. Chandramouli . (2003) Role based access control.
    18. 18)
      • Gordon, A.D., Jeffrey, A.: `Types and effects for asymmetric cryptographic protocols', IEEE Computer Security Foundations Workshop (CSFW), June 2002.
    19. 19)
    20. 20)
      • Didriksen, T.: `Rule based database access control—a practical approach', Proc. 2nd ACM Workshop on Role-based access control, 1997, Fairfax, Virginia, US, p. 143–151.
    21. 21)
      • D. Yellin , R. Strom . Protocol specifications and component adaptors. ACM Trans. Program. Languages Syst. , 2 , 292 - 333
    22. 22)
      • F.B. Schneider . Enforced security policies. ACM Trans. Inf. Syst. Security , 1 , 30 - 50
    23. 23)
      • R.S. Sandhu , E.J. Coyne , H.L. Feinstein , C.E. Youman . Role-based access control models. IEEE Comput. , 2 , 38 - 47
    24. 24)
      • B.W. Lampson . Protection. ACM SIGOPS Operating Syst. Rev. , 1 , 18 - 24
    25. 25)
    26. 26)
      • Bugliesi, M., Colazzo, D., Crafa, S.: `Type based discretionary access control', Fifteenth Int. Conf. Concurrency Theory (CONCUR 2004), 31 August–3 September 2004, London, England.
    27. 27)
      • H. Mantel . (2001) Information flow control and applications – bridging a gap.
    28. 28)
      • A.C. Myers , B. Liskov . Protecting privacy using the decentralized label model. ACM Trans. Softw. Eng. Method. , 4 , 410 - 442
    29. 29)
      • Kupferman, O., Vardi, M.Y.: `Module checking revisited', Proc. 9th Int. Conf. Computer Aided Verification LNCS 1254, 1997, p. 36–47.
    30. 30)
      • Public deliverables of the Space4U project: URL http:\\www.hitech-projects.com\euprojects\space4u\deliverables.htm.
http://iet.metastore.ingenta.com/content/journals/10.1049/iet-sen_20070026
Loading

Related content

content/journals/10.1049/iet-sen_20070026
pub_keyword,iet_inspecKeyword,pub_concept
6
6
Loading
Print this page
This is a required field
Please enter a valid email address