{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,30]],"date-time":"2025-10-30T07:05:09Z","timestamp":1761807909618,"version":"3.41.0"},"publisher-location":"Cham","reference-count":30,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319167442"},{"type":"electronic","value":"9783319167459"}],"license":[{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2015]]},"DOI":"10.1007\/978-3-319-16745-9_9","type":"book-chapter","created":{"date-parts":[[2015,3,29]],"date-time":"2015-03-29T02:13:35Z","timestamp":1427595215000},"page":"150-169","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["A Model-Driven Security Requirements Approach to Deduce Security Policies Based on OrBAC"],"prefix":"10.1007","author":[{"given":"Denisse Mu\u00f1ante","family":"Arzapalo","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vanea","family":"Chiprianov","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Laurent","family":"Gallon","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Philippe","family":"Aniort\u00e9","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2015,3,28]]},"reference":[{"key":"9_CR1","volume-title":"Security Engineering: A Guide to Building Dependable Distributed Systems","author":"R Anderson","year":"2001","unstructured":"Anderson, R.: Security Engineering: A Guide to Building Dependable Distributed Systems. Wiley, New York (2001)"},{"key":"9_CR2","volume-title":"MDA Explained-the Model Driven Architecture: Practice and Promise","author":"A Kleppe","year":"2003","unstructured":"Kleppe, A., Warmer, J., Bast, W.: MDA Explained-the Model Driven Architecture: Practice and Promise. Addison-Wesley, Boston (2003)"},{"unstructured":"Mi\u00e9ge, A.: Definition of a formal framework for specifying security policies. The Or-BAC model and extensions, Ph.D. Thesis (2005)","key":"9_CR3"},{"key":"9_CR4","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"412","DOI":"10.1007\/3-540-45800-X_32","volume-title":"UML 2002 - The Unified Modeling Language. Model Engineering, Concepts, and Tools","author":"J J\u00fcrjens","year":"2002","unstructured":"J\u00fcrjens, J.: UMLsec: extending UML for secure systems development. In: J\u00e9z\u00e9quel, J.-M., Hussmann, H., Cook, S. (eds.) UML 2002. LNCS, vol. 2460, pp. 412\u2013425. Springer, Heidelberg (2002)"},{"unstructured":"Cuppens, F., Mi\u00e8ge, A.: Modelling contexts in the Or-BAC model. In: 19th Annual Computer Security Applications Conference, December 2003","key":"9_CR5"},{"unstructured":"Cuppens, F., Cuppens-Boulahia, N., Mi\u00e8ge, A.: Inheritance hierarchies in the Or-BAC model and application in a network environment. In: Second Foundations of Computer Security Workshop (FCS 2004) (2004)","key":"9_CR6"},{"unstructured":"Ben Ghorbel, M., Cuppens, F., Cuppens-Boulahia, N., Bouhoula, A.: Managing delegation in access control models. In: 15th International Conference on Advanced Computing and Communication (ADCOM 2007), Inde (2007)","key":"9_CR7"},{"issue":"1","key":"9_CR8","doi-asserted-by":"publisher","first-page":"127","DOI":"10.1016\/j.datak.2011.09.001","volume":"71","author":"Y Elrakaiby","year":"2012","unstructured":"Elrakaiby, Y., Cuppens, F., Cuppens-Boulahia, N.: Formal enforcement and management of obligation policies. Data Knowl. Eng. 71(1), 127\u2013147 (2012)","journal-title":"Data Knowl. Eng."},{"unstructured":"Autrel, F., Cuppens, F., Cuppens-Boulahia, N., Coma, C.: MotOrBAC 2: a security policy tool. In: Third Joint Conference on Security in Networks Architectures and Security of Information Systems (SARSSI) (2008)","key":"9_CR9"},{"doi-asserted-by":"crossref","unstructured":"Mu\u00f1ante, D., Gallon, L., Aniort\u00e9, P.: An approach based on Model-driven Engineering to define Security Policies using the access control model OrBAC. In: The Eight International Workshop on Frontiers in Availability, Reliability and Security (FARES) (2013)","key":"9_CR10","DOI":"10.1109\/ARES.2013.44"},{"unstructured":"Mu\u00f1ante, D., Gallon, L., Aniort\u00e9, P.: MoDELO: a MOdel-Driven sEcurity poLicy approach based on Orbac. In: 8\u00e8me Conf\u00e9rence sur la S\u00e9curit\u00e9 des Architectures R\u00e9seaux et des Syst\u00e8mes d\u2019Information (SARSII) (2013)","key":"9_CR11"},{"key":"9_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"79","DOI":"10.1007\/978-3-319-10975-6_6","volume-title":"Availability, Reliability, and Security in Information Systems","author":"D Mu\u00f1ante","year":"2014","unstructured":"Mu\u00f1ante, D., Chiprianov, V., Gallon, L., Aniort\u00e9, P.: A review of security requirements engineering methods with respect to risk analysis and model-driven engineering. In: Teufel, S., Min, T.A., You, I., Weippl, E. (eds.) CD-ARES 2014. LNCS, vol. 8708, pp. 79\u201393. Springer, Heidelberg (2014)"},{"unstructured":"Lin, L., Nuseibeh, B., Ince, D., Jackson, M.: Using abuse frames to bound the scope of security problems. In: Proceedings of the 12th IEEE International Conference on Requirements Engineering (RE 2004), pp. 354\u2013355. IEEE Computer Society (2004)","key":"9_CR13"},{"issue":"1","key":"9_CR14","doi-asserted-by":"publisher","first-page":"34","DOI":"10.1007\/s00766-004-0194-4","volume":"10","author":"G Sindre","year":"2005","unstructured":"Sindre, G., Opdahl, A.L.: Eliciting security requirements with misuse cases. Requir. Eng. J. 10(1), 34\u201344 (2005)","journal-title":"Requir. Eng. J."},{"key":"9_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"355","DOI":"10.1007\/978-3-540-73031-6_27","volume-title":"Requirements Engineering: Foundation for Software Quality","author":"G Sindre","year":"2007","unstructured":"Sindre, G.: Mal-activity diagrams for capturing attacks on business processes. In: Heymans, P., Sawyer, P. (eds.) REFSQ 2007. LNCS, vol. 4542, pp. 355\u2013366. Springer, Heidelberg (2007)"},{"doi-asserted-by":"crossref","unstructured":"van Lamsweerde, A.: Elaborating security requirements by construction of intentional anti-models. In: Proceedings of the 26th International Conference on Software Engineering, pp. 148\u2013157, 23\u201328 May 2004","key":"9_CR16","DOI":"10.1109\/ICSE.2004.1317437"},{"issue":"2","key":"9_CR17","doi-asserted-by":"publisher","first-page":"285","DOI":"10.1142\/S0218194007003240","volume":"17","author":"H Mouratidis","year":"2007","unstructured":"Mouratidis, H., Giorgini, P.: Secure tropos: a security-oriented extension of the tropos methodology. Int. J. Softw. Eng. Knowl. Eng. 17(2), 285\u2013309 (2007)","journal-title":"Int. J. Softw. Eng. Knowl. Eng."},{"doi-asserted-by":"crossref","unstructured":"Elahi, G., Yu, E.: A goal oriented approach for modeling and analyzing security trade-offs. University of Toronto. Technical report (2007)","key":"9_CR18","DOI":"10.1007\/978-3-540-75563-0_26"},{"doi-asserted-by":"crossref","unstructured":"Anton, A.I., Earp, J.B.: Strategies for developing policies and requirements for secure electronic commerce systems. North Carolina State University. Technical report (2000)","key":"9_CR19","DOI":"10.1007\/978-1-4615-1467-1_5"},{"issue":"1","key":"9_CR20","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1007\/s10550-007-0013-9","volume":"25","author":"F Braber","year":"2007","unstructured":"Braber, F., Hogganvik, I., Lund, M.S., Stolen, K., Vraalsen, F.: Model-based security analysis in seven steps-a guided tour to the CORAS method. BT Technol. J. 25(1), 101\u2013117 (2007)","journal-title":"BT Technol. J."},{"doi-asserted-by":"crossref","unstructured":"Asnar, Y., Giorgini, Y.P., Massacci, F., Zannone, N.: From trust to dependability through risk analysis. In: Proceedings of the International Conference on Availability, Reliability and Security (AReS), pp. 19\u201326. IEEE Computer Society (2007)","key":"9_CR21","DOI":"10.1109\/ARES.2007.93"},{"unstructured":"Mayer, N., Rifaut, A., Dubois, E.: Towards a risk-based security requirements engineering framework. In: Proceedings of the 11th International Workshop on Requirements Engineering: Foundation for Software Quality (REFSQ 2005), in Conjunction with the 17th Conference on Advanced Information Systems Engineering (CAiSE 2005) (2005)","key":"9_CR22"},{"key":"9_CR23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1087","DOI":"10.1007\/978-3-540-88873-4_11","volume-title":"On the Move to Meaningful Internet Systems: OTM 2008","author":"F Massacci","year":"2008","unstructured":"Massacci, F., Zannone, N.: A model-driven approach for the specification and analysis of access control policies. In: Meersman, R., Tari, Z. (eds.) OTM 2008, Part II. LNCS, vol. 5332, pp. 1087\u20131103. Springer, Heidelberg (2008)"},{"doi-asserted-by":"crossref","unstructured":"Ledru, Y., Richier, J., Idani, A., Labiadh, M.: From KAOS to RBAC: a case study in designing access control rules from a requirements analysis. In: 6\u00e8me Conf. sur la S\u00e9curit\u00e9 des Architectures R\u00e9seaux et des Syst\u00e8mes d\u2019Information (SARSSI 2011) (2011)","key":"9_CR24","DOI":"10.1109\/SAR-SSI.2011.5931378"},{"key":"9_CR25","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"48","DOI":"10.1007\/11767138_5","volume-title":"Advanced Information Systems Engineering","author":"H Mouratidis","year":"2006","unstructured":"Mouratidis, H., J\u00fcrjens, J., Fox, J.: Towards a comprehensive framework for secure systems development. In: Martinez, F.H., Pohl, K. (eds.) CAiSE 2006. LNCS, vol. 4001, pp. 48\u201362. Springer, Heidelberg (2006)"},{"key":"9_CR26","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"155","DOI":"10.1007\/978-3-642-28879-1_11","volume-title":"Data Privacy Management and Autonomous Spontaneus Security","author":"M Graa","year":"2012","unstructured":"Graa, M., Cuppens-Boulahia, N., Autrel, F., Azkia, H., Cuppens, F., Coatrieux, G., Cavalli, A., Mammar, A.: Using requirements engineering in an automatic security policy derivation process. In: Garcia-Alfaro, J., Navarro-Arribas, G., Cuppens-Boulahia, N., de Capitani di Vimercati, S. (eds.) DPM 2011 and SETOP 2011. LNCS, vol. 7122, pp. 155\u2013172. Springer, Heidelberg (2012)"},{"key":"9_CR27","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"232","DOI":"10.1007\/978-3-642-19811-3_17","volume-title":"Fundamental Approaches to Software Engineering","author":"D Hatebur","year":"2011","unstructured":"Hatebur, D., Heisel, M., J\u00fcrjens, J., Schmidt, H.: Systematic development of UMLsec design models based on security requirements. In: Giannakopoulou, D., Orejas, F. (eds.) FASE 2011. LNCS, vol. 6603, pp. 232\u2013246. Springer, Heidelberg (2011)"},{"unstructured":"Yu, E.: Modelling strategic relationships for process reengineering. Ph.D. thesis, University of Toronto (1995)","key":"9_CR28"},{"issue":"1","key":"9_CR29","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1007\/s00766-009-0090-z","volume":"15","author":"G Elahi","year":"2010","unstructured":"Elahi, G., Yu, E., Zannone, N.: A vulnerability-centric requirements engineering framework: analyzing security attacks, countermeasures, and requirements based on vulnerabilities. Requir. Eng. 15(1), 41\u201362 (2010)","journal-title":"Requir. Eng."},{"key":"9_CR30","doi-asserted-by":"publisher","first-page":"38","DOI":"10.1109\/2.485845","volume":"29","author":"JR Sandhu","year":"1996","unstructured":"Sandhu, J.R., Coyne, E.J., Feinstein, H.J., Youman, C.E.: Role-based access control models. IEEE Comput. 29, 38\u201347 (1996)","journal-title":"IEEE Comput."}],"container-title":["Lecture Notes in Computer Science","Information Security and Cryptology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-16745-9_9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,21]],"date-time":"2025-05-21T18:19:49Z","timestamp":1747851589000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-16745-9_9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015]]},"ISBN":["9783319167442","9783319167459"],"references-count":30,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-16745-9_9","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2015]]},"assertion":[{"value":"28 March 2015","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}