Modeling process-related RBAC models with extended UML activity models

ContextBusiness processes are an important source for the engineering of customized software systems and are constantly gaining attention in the area of software engineering as well as in the area of information and system security. While the need to integrate processes and role-based access control (RBAC) models has been repeatedly identified in research and practice, standard process modeling languages do not provide corresponding language elements.

...ME and binding constraints are usually specied on role- or task-level (see, e.g., [1], [11], [12], [14])...
...In [12], the UML2 metamodel extension BusinessActivities was presented which allows for modeling process-related RBAC models...
...In [9], [12], modeling support for roles, tasks, and duties in business processes is provided via extended UML2 Activity diagrams...
...In addition, the Object Constraint Language (OCL) [7] is applied in [9], [12] to formally dene the semantics of the newly introduced UML elements and to ensure the consistency of the extended UML models...
...For a complete denition of the semantics of all new modeling elements, please refer to the denition of the metamodel extensions in [9], [12]...
...A BusinessActivity is a special UML Activity (see Figure 1). It can include all elements available for ordinary UML Activities in addition to the newly introduced elements presented in [12]...
...ME and binding constraints can be dened on Business Actions (see [12] for further details)...
...Duties can be dened as statically mutual exclusive (SME) (see, e.g., [3], [11], [12], [14])...
...subject binding (SB) or role binding (RB) of duties (see, e.g., [11], [12], [13])...
...RB, and SB constraints for Duties in Business Activities (see Figure 1). In [12], the denition of ME and binding constraints on Business Actions is motivated...
...Moreover, it is not possible to dene a DME constraint on D2 and D4. DME Duties are executed by two dierent subjects during one process instance, while SME Business Actions need to be executed by two dierent subjects in all process instances (see also [12])...
...In contrast, a DME constraint denes that during one process instance the instances of two Business Actions must not be performed by the same subject [12]...
...The attributes executingSubject and responsibleSubject determine the Subjects that execute a particular Business Action or Duty instance, respectively (see [9], [12])...

Keywords (7)

Citation Context (3)

Marcello La Rosa, et al. Managing Process Model Complexity via Abstract Syntax Modifications

Sigrid Schefer. Consistency Checks for Duties in Extended UML2 Activity Models

Jihyun Lee, et al. Access Control Using Extended Role Graph Corresponding to Organization...

References (45)

Formalization and Verification of Event-driven Process Chains (Citations: 127)

YAWL: Yet Another Workflow Language (Citations: 222)

Role-based authorization constraints specification (Citations: 217)

Constraint based role based access control in the SECTET-frameworkA model-driven approach (Citations: 4)

Model driven security: From UML models to access control infrastructures (Citations: 134)

Citations (3)

Managing Process Model Complexity via Abstract Syntax Modifications

Consistency Checks for Duties in Extended UML2 Activity Models

Access Control Using Extended Role Graph Corresponding to Organizational Hierarchy


	The following links allow you to view full publications. These links are maintained by other sources not affiliated with Microsoft Academic Search.


	BibTex \| RIS \| RefWorks Download