An Access Control Model to Facilitate Healthcare Information Access in Context of Team Collaboration

The delivery of healthcare relies on the sharing of patients information among a group of healthcare professionals (so-called multidisciplinary teams (MDTs)). At present, electronic health records (EHRs) are widely utilized system to create, manage and share patient healthcare information among MDTs. While it is necessary to provide healthcare professionals with privileges to access patient health information, providing too many privileges may backfire when healthcare professionals accidentally or intentionally abuse their privileges. Hence, finding a middle ground, where the necessary privileges are provided and malicious usage are avoided, is necessary. This thesis highlights the access control matters in collaborative healthcare domain. Focus is mainly on the collaborative activities that are best accomplished by organized MDTs within or among healthcare organizations with an objective of accomplishing a specific task (patient treatment). Initially, we investigate the importance and challenges of effective MDTs treatment, the sharing of patient healthcare records in healthcare delivery, patient data confidentiality and the need for flexible access of the MDTs corresponding to the requirements to fulfill their duties. Also, we discuss access control requirements in the collaborative environment with respect to EHRs and usage scenario of MDTs collaboration. Additionally, we provide summary of existing access control models along with their pros and cons pertaining to collaborative health systems. Second, we present a detailed description of the proposed access control model. In this model, the MDTs is classified based on Belbin’s team role theory to ensure that privileges are provided to the actual needs of healthcare professionals and to guarantee confidentiality as well as protect the privacy of sensitive patient information. Finally, evaluation indicates that our access control model has a number of advantages including flexibility in terms of permission management, since roles and team roles can be updated without updating privilege for every user. Moreover, the level of fine-grained control of access to patient EHRs that can be authorized to healthcare providers is managed and controlled based on the job required to meet the minimum necessary standard and need-to-know principle. Additionally, the model does not add significant administrative and performance overhead.publishedVersio

Reasoning on the usage control security policies over data artifact business process models

The inclusion of security aspects in organizations is a crucial aspect to ensure compliance with both internal and external regulations. Business process models are a well-known mechanism to describe and automate the activities of the organizations, which should include security policies to ensure the correct performance of the daily activities. Frequently, these security policies involve complex data which cannot be represented using the standard Business Process Model Notation (BPMN). In this paper, we propose the enrichment of the BPMN with a UML class diagram to describe the data model, that is also combined with security policies defined using the UCONABC framework annotated within the business process model. The integration of the business process model, the data model, and the security policies provides a context where more complex reasoning can be applied about the satisfiability of the security policies in accordance with the business process and data models. To do so, wetransform the original models, including security policies, into the BAUML framework (an artifact-centric approach to business process modelling). Once this is done, it is possible to ensure that there are no inherent errors in the model (verification) and that it fulfils the business requirements (validation), thus ensuring that the business process and the security policies are compatible and that they are aligned with the business security requirements.This work has been supported by Project PID2020-112540RB-C44 funded by MCIN/AEI/ 10.13039/501100011033, Project TIN2017-87610-R funded by MCIN/AEI/10.13039/501100011033 and FEDER “Una manera de hacer Europa”, Project 2017-SGR-1749 by the Generalitat de Catalunya, Projects COPERNICA (P20 01224) and METAMORFOSIS by the Junta de Andalucía.Peer ReviewedPostprint (published version

An Implementation of a Process-Oriented Cross-System Compliance Monitoring Approach in a SAP ERP and BI Environment

Compliance to regulatory demands has become a crucial matter for organizations. Non-observancemay lead to far-reaching consequences, e.g. damage to reputation, decline of credit rating or marketvalue, fraud and fines. The success of compliance management correlates with the frequency ofmonitoring and reporting and is affected by complex and often time-consuming manual validationtasks. To address this problem, organizations implement corresponding IT solutions. However, theoften heterogeneous system landscapes, the different information sources and their integrationrepresent major challenges.This paper presents an implementation of a novel process-oriented and cross-system compliancemonitoring approach. The approach is based on a model which provides for the annotation ofbusiness processes with internal controls, critical permissions and roles as well as an architecturewhich provides for the automatic detection, timely communication and deep analysis of controlexceptions. It solely relies on established standards (i.e. XACML, BPMN, COSO and SWRL) andexisting technologies. The implementation has been deployed in a productive SAP ERP and BIenvironment. It automatically converts access control data from the proprietary SAP model andpublishes control exceptions to the BI system. The effects and causes of these control exception can beappropriately analyzed using BI queries and reports

Architectural Alignment of Access Control Requirements Extracted from Business Processes

Geschäftsprozesse und IT-Systeme sind einer ständigen Evolution unterworfen und beeinflussen sich in hohem Maße gegenseitig. Dies führt zu der Herausforderung, Sicherheitsaspekte innerhalb von Geschäftsprozessen und Enterprise Application Architectures (EAAs) in Einklang zu bringen. Im Besonderen gilt dies für Zugriffskontrollanforderungen, welche sowohl in der IT-Sicherheit als auch im Datenschutz einen hohen Stellenwert haben. Die folgenden drei Ziele der Geschäftsebene verdeutlichen die Bedeutung von Zugriffskontrollanforderungen: $1)$ Identifikation und Schutz von kritischen und schützenswerten Daten und Assets. $2)$ Einführung einer organisationsweiten IT-Sicherheit zum Schutz vor cyberkriminellen Attacken. $3)$ Einhaltung der zunehmenden Flut an Gesetzen, welche die IT-Sicherheit und den Datenschutz betreffen. Alle drei Ziele sind in einem hohen Maß mit Zugriffskontrollanforderungen auf Seiten der Geschäftsebene verbunden. Aufgrund der Fülle und Komplexität stellt die vollständige und korrekte Umsetzung dieser Zugriffskontrollanforderungen eine Herausforderung für die IT dar. Hierfür muss das Wissen von der Geschäftsebene hin zur IT übertragen werden. Die unterschiedlichen Terminologien innerhalb der Fachdomänen erschweren diesen Prozess. Zusätzlich beeinflussen die Größe von Unternehmen, die Komplexität von EAAs sowie die Verflechtung zwischen EAAs und Geschäftsprozessen die Fehleranfälligkeit im Entwurfsprozess von Zugriffsberechtigungen und EAAs. Dieser Zusammenhang führt zu einer Diskrepanz zwischen ihnen und den Geschäftsprozessen und wird durch den Umstand der immer wiederkehrenden Anpassungen aufgrund von Evolutionen der Geschäftsprozesse und IT-Systeme verstärkt. Bisherige Arbeiten, die auf Erweiterungen von Modellierungssprachen setzen, fordern einen hohen Aufwand von Unternehmen, um vorhandene Modelle zu erweitern und die Erweiterungen zu pflegen. Andere Arbeiten setzen auf manuelle Prozesse. Diese erfordern viel Aufwand, skalieren nicht und sind bei komplexen Systemen fehleranfällig. Ziel meiner Arbeit ist es, zu untersuchen, wie Zugriffskontrollanforderungen zwischen der Geschäftsebene und der IT mit möglichst geringem Mehraufwand für Unternehmen angeglichen werden können. Im Speziellen erforsche ich, wie Zugriffskontrollanforderungen der Geschäftsebene, extrahiert aus Geschäftsprozessen, automatisiert in Zugriffsberechtigungen für Systeme der rollenbasierten Zugriffskontrolle (RBAC) überführt werden können und wie die EAA zur Entwurfszeit auf die Einhaltung der extrahierten Zugriffskontrollanforderungen überprüft werden kann. Hierdurch werden Sicherheitsexperten beim Entwerfen von Zugriffsberechtigungen für RBAC Systeme unterstützt und die Komplexität verringert. Weiterhin werden Enterprise-Architekten in die Lage versetzt, die EAA zur Entwurfszeit auf Datenflüsse von Services zu untersuchen, welche gegen die geschäftsseitige Zugriffskontrollanforderungen verstoßen und diese Fehler zu beheben. Die Kernbeiträge meiner Arbeit lassen sich wie folgt zusammenfassen: $\textbf{I)}$ Ein Ansatz zur automatisierten Extraktion von geschäftsseitigen Zugriffskontrollanforderungen aus Geschäftsprozessen mit anschließender Generierung eines initialen Rollenmodells für RBAC. $\textbf{II)}$ Ein Ansatz zum automatisierten Erstellen von architekturellen Datenfluss-Bedingungen aus Zugriffskontrollanforderungen zur Identifikation von verbotenen Datenflüssen in Services von IT-Systemen der EAA. $\textbf{III)}$ Eine Prozessmodell für Unternehmen über die Einsatzmöglichkeiten der Ansätze innerhalb verschiedener Evolutionsszenarien. $\textbf{IV)}$ Ein Modell zur Verknüpfung relevanter Elemente aus Geschäftsprozessen, RBAC und EAAs im Hinblick auf die Zugriffskontrolle. Dieses wird automatisiert durch die Ansätze erstellt und dient unter anderem zur Dokumentation von Entwurfsentscheidungen, zur Verbesserung des Verständnisses von Modellen aus anderen Domänen und zur Unterstützung des Enterprise-Architekten bei der Auflösung von Fehlern innerhalb der EAA. Die Anwendbarkeit der Ansätze wurden in zwei Fallstudien untersucht. Die erste Studie ist eine Real-Welt-Studie, entstanden durch eine Kooperation mit einer staatlichen Kunsthalle, welche ihre IT-Systeme überarbeitet. Eine weitere Fallstudie wurde auf Basis von Common Component Modeling Example (CoCoME) durchgeführt. CoCoME ist eine durch die Wissenschaftsgemeinde entwickelte Fallstudie einer realistischen Großmarkt-Handelskette, welche speziell für die Erforschung von Software-Modellierung entwickelt wurde und um Evolutinsszenarien ergänzt wurde. Aufgrund verschiedener gesetzlicher Regularien an die IT-Sicherheit und den Datenschutz sowie dem Fluss von sensiblen Daten eignen sich beide Fallstudien für die Untersuchung von Zugriffskontrollanforderungen. Beide Fallstudien wurden anhand der Goal Question Metric-Methode durchgeführt. Es wurden Validierungsziele definiert. Aus diesen wurden systematisch wissenschaftliche Fragen abgleitet, für welche anschließend Metriken aufgestellt wurden, um sie zu untersuchen. Die folgenden Aspekte wurden untersucht: $\bullet$ Qualität der generierten Zugriffsberechtigungen. $\bullet$ Qualität der Identifikation von fehlerhaften Datenflüssen in Services der EAA. $\bullet$ Vollständigkeit und Korrektheit des generierten Modells zur Nachverfolgbarkeit von Zugriffskontrollanforderungen über Modelle hinweg. $\bullet$ Eignung der Ansätze in Evolutionsszenarien von Geschäftsprozessen und EAAs. Am Ende dieser Arbeit wird ein Ausblick gegeben, wie sich die vorgestellten Ansätze dieser Arbeit erweitern lassen. Dabei wird unter anderem darauf eingegangen, wie das Modell zur Verknüpfung relevanter Elemente aus Geschäftsprozessen, RBAC und EAAs im Hinblick auf die Zugriffskontrolle, um Elemente aus weiteren Modellen der IT und der Geschäftsebene, erweitert werden kann. Weiterhin wird erörtert wie die Ansätze der Arbeit mit zusätzlichen Eingabeinformationen angereichert werden können und wie die extrahierten Zugriffskontrollanforderungen in weiteren Domänenmodellen der IT und der Geschäftsebene eingesetzt werden können

Model-Based Analysis of Role-Based Access Control

Model-Driven Engineering (MDE) has been extensively studied. Many directions have been explored, sometimes with the dream of providing a fully integrated approach for designers, developers and other stakeholders to create, reason about and modify models representing software systems. Most, but not all, of the research in MDE has focused on general-purpose languages and models, such as Java and UML. Domain-specific and cross-cutting concerns, such as security, are increasingly essential parts of a software system, but are only treated as second-class citizens in the most popular modelling languages. Efforts have been made to give security, and in particular access control, a more prominent place in MDE, but most of these approaches require advanced knowledge in security, programming (often declarative), or both, making them difficult to use by less technically trained stakeholders. In this thesis, we propose an approach to modelling, analysing and automatically fixing role-based access control (RBAC) that does not require users to write code or queries themselves. To this end, we use two UML profiles and associated OCL constraints that provide the modelling and analysis features. We propose a taxonomy of OCL constraints and use it to define a partial order between categories of constraints, that we use to propose strategies to speed up the models’ evaluation time. Finally, by representing OCL constraints as constraints on a graph, we propose an automated approach for generating lists of model changes that can be applied to an incorrect model in order to fix it. All these features have been fully integrated into a UML modelling IDE, IBM Rational Software Architect

Model-Based Analysis of Role-Based Access Control

Model-Driven Engineering (MDE) has been extensively studied. Many directions have been explored, sometimes with the dream of providing a fully integrated approach for designers, developers and other stakeholders to create, reason about and modify models representing software systems. Most, but not all, of the research in MDE has focused on general-purpose languages and models, such as Java and UML. Domain-specific and cross-cutting concerns, such as security, are increasingly essential parts of a software system, but are only treated as second-class citizens in the most popular modelling languages. Efforts have been made to give security, and in particular access control, a more prominent place in MDE, but most of these approaches require advanced knowledge in security, programming (often declarative), or both, making them difficult to use by less technically trained stakeholders. In this thesis, we propose an approach to modelling, analysing and automatically fixing role-based access control (RBAC) that does not require users to write code or queries themselves. To this end, we use two UML profiles and associated OCL constraints that provide the modelling and analysis features. We propose a taxonomy of OCL constraints and use it to define a partial order between categories of constraints, that we use to propose strategies to speed up the models’ evaluation time. Finally, by representing OCL constraints as constraints on a graph, we propose an automated approach for generating lists of model changes that can be applied to an incorrect model in order to fix it. All these features have been fully integrated into a UML modelling IDE, IBM Rational Software Architect

Modeling input validation in UML

Security is an integral part of most software systems but it is not considered as an explicit part in the development process yet. Input validation is the most critical part ofsoftware security that is not covered in the design phase of software development life-cycle resulting in many security vulnerabilities. Our objective is to extend UML to new integrated jramework for model driven security engineering leading to ideal way to design more secure software. Input validation in UML has not been addressed previously, hence we incorporate input validation into UML diagrams such as use case, class, sequence and activity. This approach has some advantages such as preventing jrom common input tampering attacks, having both security and convenience in software at high level of abstraction and ability of solving the problem ofweak security backgroundfor developers

Role-Based Access Control Using Knowledge Acquisition in Automated Specification

Turvalisust peetakse infosüsteemide üheks aspektiks. RBAC on lähenemine, mis piirab süsteemi ligipääsu ainult autoriseeritud kasutajatele infosüsteemides. Olemasolevad turvalisusmudelite keeled või lähenemised adresseerivad IS-i turvalisust, kuigi olemasolevad keeled või lähenemised tingimata ei kohandu RBAC-i vajadustele. On olemas mitmeid modelleerimiskeeli (nt SecureUML, UMLSec, jne) mis esindavad RBAC-i, kuid nad ei ole koosvõimelised (raske selgitada) ning neid ei ole lihtne võrrelda omavahel. Iga modelleerimiskeel esindab erinevaid perspektiive informatsioonisüsteemides. Pealegi on vajadus ühendada disain ja nõudestaadiumid selleks, et avastada süsteemi turvalisusprobleemid ja analüüsida seotud turvalisuskompromisse varasemates staadiumites. KAOS on eesmärgipõhine nõue tehnikavaatenurgast, et paika panna tarkvara nõuded. Sellel hetkel, KAOS on tulevikus võtmelahendus selleks, et kombineerida nõuded disainipõhimõtetega. Selles teesis me analüüsime KAOS-e võimet kohaneda RBAC-ile. Täpsemalt, me kasutame süstemaatilist lähenemist selleks, et aru saada kuidas KAOS-t on võimalik kasutada nii, et see kohanduks RBAC-ile. Meie uurimistöö põhineb transformatsioonireeglitel KAOS-SecureUML-i ja KAOS-UMLSec-i vahel. Pealegi, läbi nende muutuste näitame me kuidas sobitasime KAOS-e RBAC-ile. Selle uurimistöö esitamisel on mitmeid kasutegureid. Esiteks, see aitab potentsiaalselt mõista kuidas KAOS toimib koos RBAC-iga. Teiseks, see defineerib lähenemise välja meelitada turvanõuetele IS-i varajastes arendusfaasides RBAC-i jaoks. See rakendab meie tulemused juhtumuuringus selleks, et mõõta määratletud lähenemise õigsust. Kolmandaks, see transformatsioon KAOS-est/KAOS-eni aitaks IS arendajaid ja teistel süsteemi osanikel (nt süsteemianalüütikuid, süsteemi administraatoreid jne) mõista kui tähtsad need turvalisuslähenemised on ja millistel on rohkem eeliseid/puudusi. Me planeerime kehtestada oma tulemused selleks, et reegleid ja modeleid muuta olenevalt nende õigsust, mida mõõdetakse. Viimaseks, me oleme võimelised õigustama oma disainistaadiumit nõudmise staadiumiga.Security is considered to be an aspect of information systems. Role-based access control (RBAC) is an approach to restricting system access to authorized users in information systems. Existing security modeling languages and/or approaches address the security of the IS, however existing languages or approaches do not necessarily conforms to the needs of RBAC. There are several modeling languages (e.g. SecureUML, UMLSec, etc.) to represent RBAC but they are not interoperable and it is not easy to compare one with another. Each modeling language represents different perspectives on information systems. Besides, there is a need to merge design and requirement stages in order to discover system security concerns and analyze related security trade-offs at the earlier stages. Knowledge acquisition in automated specification (KAOS) is a goal oriented requirement engineering approach to elicit software requirements. In this point, KAOS will be a key solution in order to combine requirements with design principles. In this thesis, we will analyze KAOS to apply RBAC. More specifically, we will apply a systematic approach to understand how KAOS can be used to apply RBAC. Our research work will be based on the transformation rules between KAOS-SecureUML and KAOS-UMLSec, and vice versa. Moreover, through these transformations we will show how we aligned KAOS to RBAC. The contribution of this research has several benefits. Firstly, it will potentially help to understand how KAOS could deal with RBAC. Secondly it will define the approach to elicit security requirements for RBAC at early stages of the IS development. This will apply our results in a case study to measure the correctness of the defined approach. Thirdly, the transformations from/to the KAOS would help IS developers and the other system stakeholders (e.g. system analysts, system administrators, etc.) to understand how important these security approaches (KAOS, SecureUML and UMLSec) are and which one has more advantages/disadvantages. We plan to validate our results for transformation rules and the models regarding their correctness that will be measured. Last but not least, we will be able to justify the design stage with requirement stage

Framework for automatic verification of UML design models : application to UML 2.0 interactions

Software-intensive systems have become extremely complex and susceptible to defects and vulnerabilities. At the same time, the consequences of software errors have also become much more severe. In order to reduce the overall development cost and assure the security and reliability of the final product, it is of critical importance to investigate techniques able to detect defects as early as possible in the software development process, where the costs of repairing a software flaw are much lower than at the maintenance phase. In this research work, we propose an approach for detecting flaw at the design phase by combining two highly successful techniques in the information technology (IT) industry in the field of modeling languages and verification technologies. The first one is the Unified Modeling Language (UML). It has become the de facto language for software specification and design. UML is now used by a wide range of professionals with very different background. The second one is Model Checking , which is a formal verification technique that allows the desired properties to be verified through the inspection of all possible states of the model under consideration. Despite the fact that Model Checking gives significant capabilities to developers in order to create a secure design of the system, they are still not very popular in the UML community. There are many challenges faced by UML developers when it comes to combine UML with model checking (e.g., developer are not familiar with formal logics, the verification result is not in the UML notation, and the generation of the model checkers code from UML models is a problematic task). The proposed approach addresses these problems by implementing a new verification framework with support to property specification without using the complexity of formal languages, UML-like notation for the verification results, and a fully automatic verification proces

Role Based Access Control as SecureUML Model in Web Applications Development with Spring Security

Tänapäeval on efektiivse äri üheks võtmeks kiire ja edukas veebirakenduste arendus. Samas, uudsed maailmas levinud nõuded eeldavad keerukat lähenemist juurdepääsukontrolli ja kasutajate rühmade koostöövõime määratlemisel. Tavapäraselt hõlmab tarkvara arenduse protsess erinevaid vastutavaid osalisi rakenduse hindamisel, plaanide koostamisel, arendusel, rakendamisel ja kasutajatoe tagamisel, mille tulemusena suureneb informatsiooni kadu ja keerukus sihtgruppide vahelises suhtluses. Arendusmeeskonnad peaksid sellise olukorra vältimiseks ja väärtõlgendustest ning turvalisuse nõuete rikkumisest tulenevate võimalike riskide leevendamiseks tarkvara arenduses kasutama vahendeid, mis võimaldavad kiiret ja täpset veebirakenduse interpreteerimist läbi mudeli. Modelleerimine aitab tunduvalt vähendada võimalikke probleeme ja tagab funktsionaalsuse vajadused arvestades soovitud rollipõhise juurdepääsukontrolli mudeliga. Antud töös pakutakse välja kontseptuaalne Eclipse IDE lisandmooduli realisatsioon, et toetada ja lihtsustada mudelil baseeruvat lähenemist veebirakenduste arendamisel kasutades Spring platvormi. Loodud lisandmoodul toetab Spring Security esitusviiside tuvastamist koos võimega visualiseerida nende üle rollipõhise juurdepääsukontrolli mudelit. Visuaalse mudeli genereerimine toimub kahe peamise astmena: Spring Security konfiguratsiooni tuvastamine ja esituse genereerimine kasutades SecureUML modelleerimise keelt. Loodud lisandmooduli kontseptsioon valideeriti juhtumiuuringutega, mis näitasid lisandmooduli sobivust tarkvara arendajate jaoks tänu integreeritud lahendusele, et tagada kiiremat arendust ja abi valitud veebirakenduse rollipõhise juurdepääsukontrolli mudelist arusaamisel.Nowadays fast and successful development of a web application is one of the keys to effective business. However, modern world requirements define the complex approach in definition of ac-cess control and user groups’ interoperability. The software development process typically in-volves different responsible members for the application assessment, planning, development, de-ployment and support, as a consequence, increasing the complexity and information losses be-tween target groups. In order to mitigate possible risks in software development misinterpretation and security violation, teams should use tools that allow fast and accurate interpretation of the web application through a model. Modelling will help with minimization of possible problems and ensure the functionality needs with respect to desired RBAC model. In order to support and simpli-fy the model-driven approach for a web application development with Spring platform, realization of a concept plugin for Eclipse IDE is proposed. This plugin supports the recognition of Spring Security notations with capability to visualize the RBAC model on top of them. The generation of visual model is achieved in two main steps: recognition of Spring Security configuration and gen-eration of representation with SecureUML modeling language. The concept of contributed plugin was validated within case studies that demonstrated the acceptance of this plugin by software de-velopers due to its integrated solution for faster development and help in understanding of RBAC model for the selected web application