Separation of Duty in Information Security

S Groll, L Fuchs, G Pernul - ACM Computing Surveys, 2025 - dl.acm.org
Separation of Duty (SoD) is a fundamental security principle that ensures that critical tasks or
functions are divided upon multiple users in order to prevent fraud. The topic of SoD spans …

Model-driven business process security requirement specification

C Wolter, M Menzel, A Schaad, P Miseldine… - Journal of Systems …, 2009 - Elsevier
Various types of security goals, such as authentication or confidentiality, can be defined as
policies for service-oriented architectures, typically in a manual fashion. Therefore, we foster …

A model-checking approach to analysing organisational controls in a loan origination process

A Schaad, V Lotz, K Sohr - Proceedings of the eleventh ACM symposium …, 2006 - dl.acm.org
Demonstrating the safety of a system (ie. avoiding the undesired propagation of access
rights or indirect access through some other granted resource) is one of the goals of access …

Analyzing and managing role-based access control policies

K Sohr, M Drouineaud, GJ Ahn… - IEEE transactions on …, 2008 - ieeexplore.ieee.org
Today more and more security-relevant data is stored on computer systems; security-critical
business processes are mapped to their digital counterparts. This situation applies to …

Representation and reasoning on rbac: A description logic approach

C Zhao, NM Heilili, S Liu, Z Lin - International colloquium on theoretical …, 2005 - Springer
Role-based access control (RBAC) is recognized as an excellent model for access control in
large-scale networked applications. Formalization of RBAC in a logical approach makes it …

Dynamic access control policies: Specification and verification

H Janicke, A Cau, F Siewe, H Zedan - The Computer Journal, 2013 - academic.oup.com
Security requirements deal with the protection of assets against unauthorized access
(disclosure or modification) and their availability to authorized users. Temporal constraints of …

Specification and validation of authorisation constraints using UML and OCL

K Sohr, GJ Ahn, M Gogolla, L Migge - … , Milan, Italy, September 12-14, 2005 …, 2005 - Springer
Authorisation constraints can help the policy architect design and express higher-level
security policies for organisations such as financial institutes or governmental agencies …

Trust-based user-role assignment in role-based access control

H Takabi, M Amini, R Jalili - 2007 IEEE/ACS International …, 2007 - ieeexplore.ieee.org
Role based access control (RBAC) model is naturally suitable to organizations where users
are assigned organizational roles with well-defined privileges. Nowadays, many …

A first step towards formal verification of security policy properties for RBAC

M Drouineaud, M Bortin, P Torrini… - … Software, 2004. QSIC …, 2004 - ieeexplore.ieee.org
Considering the current expansion of IT-infrastructure, the security of the data inside this
infrastructure becomes increasingly important. Therefore, assuring certain security …

Employing UML and OCL for designing and analysing role-based access control

M Kuhlmann, K Sohr, M Gogolla - Mathematical Structures in …, 2013 - cambridge.org
The stringent security requirements of organisations like banks or hospitals frequently adopt
role-based access control (RBAC) principles to represent and simplify their internal …