Requirements engineering for trust management: model, methodology, and reasoning
International Journal of Information SecurityPublished 15 August 2006Open access
Paolo Giorgini, Fabio Massacci, John Mylopoulos, Nicola Zannone
Citations111
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A set of concepts founded on the notions of ownership, permission, and trust and intended for requirements modeling are proposed and shown to support the automatic verification of security and trust requirements using Datalog.
Abstract
A number of recent proposals aim to incorporate security engineering into mainstream software engineering. Yet, capturing trust and security requirements at an organizational level, as opposed to an IT system level, and mapping these into security and trust management policies is still an open problem. This paper proposes a set of concepts founded on the notions of ownership, permission, and trust and intended for requirements modeling. It also extends Tropos, an agent-oriented software engineering methodology, to support security requirements engineering. These concepts are formalized and are shown to support the automatic verification of security and trust requirements using Datalog. To make the discussion more concrete, we illustrate the proposal with a Health Care case study.
Keywords
Social SciencesComputer Science
ComputerRole-based access control models
5,757 Citations1996Ravi Sandhu, Edward J. Coyne +2 more
Why RBAC is receiving renewed attention as a method of security administration and review is explained, a framework of four reference models developed to better understandRBAC is described, and the use of RBAC to manage itself is discussed.
Foundations of databases
3,400 Citations1994Serge Abiteboul, Richard Hull +1 more
Science of Computer ProgrammingGoal-directed requirements acquisition
1,971 Citations1993Anne Dardenne, Axel van Lamsweerde +1 more
An approach to requirements acquisition is presented which is driven by higher-level concepts that are currently not supported by existing formal specification languages, such as goals to be achieved, agents to be assigned, alternatives to be negotiated, etc.
Security Engineering: A Guide to Building Dependable Distributed Systems
1,836 Citations2001Ross Anderson
In almost 600 pages of riveting detail, Ross Anderson warns us not to be seduced by the latest defensive technologies, never to underestimate human ingenuity, and always use common sense in defending valuables.
Autonomous Agents and Multi-Agent SystemsTropos: An Agent-Oriented Software Development Methodology
1,737 Citations2004Paolo Bresciani, Anna Perini +3 more
The goal in this paper is to introduce and motivate a methodology, called Tropos, for building agent oriented software systems, based on the notion of agent and all related mentalistic notions, formalized in a metamodel described with a set of UML class diagrams.
Modelling strategic relationships for process reengineering
1,404 Citations1995John Mylopoulos, Eric Yu
ACM Transactions on Computational LogicThe DLV system for knowledge representation and reasoning
1,171 Citations2006Nicola Leone, Gerald Pfeifer +5 more
The experimental results confirm the solidity of DLV and highlight its potential for emerging application areas like knowledge management and information integration, and the main international projects investigating the potential of the system for industrial exploitation are described.
Design of a role-based trust-management framework
752 Citations2005Ninghui Li, John C. Mitchell +1 more
The RT framework, a family of role-based trust management languages for representing policies and credentials in distributed authorization, is introduced, and the semantics of credentials are defined by presenting a translation from credentials to Datalog rules.
Lecture notes in computer scienceSecureUML: A UML-Based Modeling Language for Model-Driven Security
748 Citations2002Torsten Lodderstedt, David Basin +1 more
The approach is based on role-based access control with additional support for specifying authorization constraints and can be used to improve productivity during the development of secure distributed systems and the quality of the resulting systems.
Requirements EngineeringEliciting security requirements with misuse cases
722 Citations2004Guttorm Sindre, Andreas L. Opdahl
This paper presents a systematic approach to eliciting security requirements based on use cases, with emphasis on description and method guidelines, and is potentially useful for several other types of extra-functional requirements beyond security.
Information SystemsTowards requirements-driven information systems engineering: the Tropos project
703 Citations2002Jaelson Castro, Manuel Kolp +1 more
This paper proposes a software development methodology named Tropos which is founded on concepts used to model early requirements, and adopts the i organizational modeling framework, which offers the notions of actor, goal and (actor) dependency.
Elsevier eBooksHippocratic Databases
634 Citations2002Rakesh Agrawal, Jerry Kiernan +2 more
It is argued that future database systems must include responsibility for the privacy of data that they manage as a founding tenet, because of the explosive progress in networking, storage, and processor technologies.
THE MEANINGS OF TRUST
563 Citations2000D. Harrison McKnight, Norman L. Chervany +1 more
Lecture notes in computer scienceThe Role of Trust Management in Distributed Systems Security
490 Citations1999Matt Blaze, Joan Feigenbaum +2 more
The concept of trust management is introduced, its basic principles are explained, and some existing trust-management engines are described, including PoHcyMaker and KeyNote, which allow for increased flexibility and expressibility, as well as standardization of modern, scalable security mechanisms.
Principles of trust for MAS: cognitive anatomy, social importance, and quantification
485 Citations2002Cristiano Castelfranchi, Rino Falcone
A principled quantification of trust is presented, based on its cognitive ingredients, to use this "degree of trust" as the basis for a rational decision to delegate or not to another agent.
ACM Transactions on Software Engineering and MethodologyModel driven security
478 Citations2006David Basin, Jürgen Doser +1 more
This work presents several instances of this schema that combine (both syntactically and semantically) different UML modeling languages with a security modeling language for formalizing access control requirements, and generates access control infrastructures for server-based applications built from declarative and programmatic access control mechanisms.
ACM Transactions on Information and System SecurityDelegation logic
427 Citations2003Ninghui Li, Benjamin N. Grosof +1 more
D1LP provides a concept of proof-of-compliance that is founded on well-understood principles of logic programming and knowledge representation, and provides a logical framework for studying delegation.
Using abuse case models for security requirements analysis
398 Citations2003John McDermott, Chris Fox
A proven object oriented modeling technique is adapted, use cases, to capture and analyze security requirements in a simple way, and its relationship to other security engineering work products is relatively simple, from a user perspective.
Journal of Lightwave TechnologySecurity and privacy requirements analysis within a social setting
393 Citations2004L. Liu, Eric Yu +1 more
A methodological framework for dealing with security and privacy requirements based on i*, an agent-oriented requirements modeling language is proposed, which supports a set of analysis techniques and helps identify potential system abusers and their malicious intents.
Eliciting security requirements by misuse cases
328 Citations2002Guttorm Sindre, Andreas L. Opdahl
SD3: a trust management system with certified evaluation
272 Citations2002Trevor Jim
SD3, a trust management system consisting of a high-level policy language, a local policy evaluation, and a certificate retrieval system, is introduced and it is shown how to implement a secure name service entirely in SD3.
Modeling security requirements through ownership, permission and delegation
214 Citations2005Paolo Giorgini, Fabio Massacci +2 more
This paper refine Secure Tropos, introducing the notions of at-least delegation and trust of execution; also, at-most delegation andTrust of permission; and proposes monitoring as a security design pattern intended to overcome the problem of lack of trust between actors.
Dealing with non-functional requirements
193 Citations1995Lawrence Chung, Brian A. Nixon
An initial evaluation of the extent to which the framework's objectives are met is given, providing preliminary support for the usefulness of certain aspects of the framework, while raising some open issues.
Model checking early requirements specifications in Tropos
174 Citations2002Ariel Fuxman, Marco Pistore +2 more
An attempt to bridge the gap between early requirements specification and formal methods is described, which proposes a new specification language, called Formal Tropos, that is founded on the primitive concepts of early requirements frameworks but supplements them with a rich temporal specification language.
Lecture notes in computer scienceFormal Reasoning Techniques for Goal Models
167 Citations2003Paolo Giorgini, John Mylopoulos +2 more
A qualitative and a numerical axiomatization for goal modeling primitives are proposed and label propagation algorithms that are shown to be sound and complete with respect to their respectiveAxiomatizations are introduced.
A policy framework for management of distributed systems
154 Citations2002Nicodemos Damianou
This paper aims to provide a chronology of the events leading to and following the publication of this book and some of the main events leading up to and including the publication.
Requirements EngineeringA requirements taxonomy for reducing Web site privacy vulnerabilities
141 Citations2003AnnieI. Ant�n, JuliaB. Earp
A taxonomy of privacy requirements for Web sites is presented, using goal-mining, the extraction of pre-requ requirements goals from post-requirements text artefacts, to develop the taxonomy that can be used by Web site designers to reduce Web site privacy vulnerabilities and ensure that their stated and actual policies are consistent with each other.
Security requirements engineering: when anti-requirements hit the fan
99 Citations2003Robert Crook, D. C. Ince +2 more
A vision is of a future in which the security requirements engineering process is informed by organisational theory, which would act as the bridge between the well-ordered world of the software project informed by conventional requirements and the unexpected world of anti-requirements associated with the malicious user.
From system goals to intruder anti-goals: attack generation and resolution for security requirements engineering
99 Citations2003Axel van Lamsweerde, Simon Brohez +2 more
A constructive approach to security requirements elicitation, modeling and analysis is outlined as an attempt to address meta-requ requirements set up by attackers to break security goals.
A security policy model for clinical information systems
98 Citations2002Ross Anderson
This article presents a clear and concise access rules for clinical information systems that was commissioned by doctors and is driven by medical ethics; it is informed by the actual threats to privacy, and reflects current best clinical practice.
International Joint Conference on Artificial IntelligenceAggregate functions in disjunctive logic programming: semantics, complexity, and implementation in DLV
97 Citations2003Tina Dell’Armi, Wolfgang Faber +3 more
This paper formally defines the semantics of the new language, named DLPA, and shows the usefulness of the new constructs on relevant knowledge-based problems, and analyzes the computational complexity of DLPA, showing that the addition of aggregates does not bring a higher cost in that respect.
Computer Standards & InterfacesUsing a security requirements engineering methodology in practice: The compliance with the Italian data protection legislation
88 Citations2005Fabio Massacci, Marco Prest +1 more
A comprehensive case study of the application of the Secure Tropos RE methodology for compliance to the Italian legislation on Privacy and Data Protection by the University of Trento, leading to the definition and analysis of a ISO-17799-like security management scheme.
Beyond proof-of-compliance: safety and availability analysis in trust management
83 Citations2004Ninghui Li, William H. Winsborough
It is found that in contrast to the classical HRU undecidability of safety properties, the primary security properties of the trust management languages studied are decidable in polynomial time.
Analyzing security requirements as relationships among strategic actors
82 Citations2002Lin Liu, Eric Yu +1 more
The explicit modeling of relationships among strategic actors in order to elicit, identify and analyze security requirements is explored, particularly suitable for new Internet applications where layers of software entities and human roles interact to create complex security challenges.
TU/e Research PortalRequirements Engineering meets trust management: Model, methodology, and reasoning
75 Citations2004Paolo Giorgini, Fabio Massacci +2 more
A formal framework for modeling and analyzing security and trust requirements is presented, which extends the Tropos methodology, an agent-oriented software engineering methodology and allows for the automatic verification of security andtrust requirements by using a suitable delegation logic that can be mechanized within Datalog.
Modelling secure multiagent systems
71 Citations2003Haralambos Mouratidis, Paolo Giorgini +1 more
Extensions to the Tropos methodology are introduced to enable it to model security concerns throughout the whole development process to help towards the development of more secure multiagent systems.
Designing for privacy and other competing requirements
61 Citations2002Eric Yu, Luiz Marcio Cysneiros
A framework to model the way agents interact with each other to achieve their goals based on the i* framework is presented and it is shown how one can model privacy concerns for each agent and the different alternatives for operationalizing it.
Legal requirements reuse: a critical success factor for requirements quality and personal data protection
59 Citations2003Ambrosio Toval, Ángel Prior Olmos +1 more
The authors investigate how recent efforts in the requirements engineering field can contribute to improving security issues in information systems, in particular those dealing with personal data.
Information Management & Computer SecurityEmbedding security practices in contemporary information systems development approaches
55 Citations2001Theo Tryfonas, Evangelos Kiountouzis +1 more
This paper addresses the lack of a defined discipline for security concerns integration in systems development by using field study results recording development practices that are currently in use to illustrate their deficiencies, to point to required enhancements of practice and to propose a list of desired features that contemporary development practices should incorporate to address security concerns.
Lecture notes in computer scienceRequirement Engineering Meets Security: A Case Study on Modelling Secure Electronic Transactions by VISA and Mastercard
51 Citations2003Paolo Giorgini, Fabio Massacci +1 more
It is shown that the i*/Tropos framework lacks the ability to capture these essential features and needs to be augmented, and the key missing concept is the separation of the notion of offering a service and ownership of the very same service.
Lecture notes in computer scienceRequirements Engineering Meets Trust Management
46 Citations2004Paolo Giorgini, Fabio Massacci +2 more
Journal of Lightwave TechnologySpecifying and analyzing early requirements: some experimental results
39 Citations2004Ariel Fuxman, L. Liu +3 more
This work proposes guidelines for producing a Formal Tropos specification from an i/sup */ diagram and for deciding what model checking technique to use when a particular formal property is to be validated.
Requirements before the requirements: understanding the upstream impacts
38 Citations2005Christof Ebert
It is found that four described techniques must be used simultaneously in order to see tangible performance improvement, and it is taken the position that only by integrating upstream and downstream processes, projects are successful.
Lecture notes in computer scienceModeling Social and Individual Trust in Requirements Engineering Methodologies
25 Citations2005Paolo Giorgini, Fabio Massacci +2 more
The goal is to model and analyze the two levels finding the link between them and supporting the automatic detection of conflicts that can come up when agents play roles in the organization.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)Detecting conflicts between functional and security requirements with Secure Tropos: John Rusnak and the Allied Irish Bank (Chapter 9)
24 Citations2011Fabio Massacci, Nicola Zannone
Lecture notes in computer scienceFilling the Gap between Requirements Engineering and Public Key/Trust Management Infrastructures
19 Citations2004Paolo Giorgini, Fabio Massacci +2 more
A formal framework for modeling and analyzing security and trust requirements, that extends the Tropos methodology for early requirements modeling, is proposed, that identifies distinct roles for actors that manipulate resources, accomplish goals or execute tasks, and actors that own or permit usage of resources or goals.
International Journal of Software Engineering and Knowledge EngineeringFROM HIPPOCRATIC DATABASES TO SECURE TROPOS: A COMPUTER-AIDED RE-ENGINEERING APPROACH
8 Citations2007Fabio Massacci, John Mylopoulos +1 more
A procedure for automatically extracting privacy requirements from databases supporting access control mechanisms for personal data and representing them in the Tropos modeling framework where tools are available for checking the correctness and consistency of privacy requirements is proposed.