{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:41:44Z","timestamp":1750308104952,"version":"3.41.0"},"reference-count":13,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2005,5,15]],"date-time":"2005-05-15T00:00:00Z","timestamp":1116115200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGSOFT Softw. Eng. Notes"],"published-print":{"date-parts":[[2005,7]]},"abstract":"<jats:p>Nowadays, more and more security-relevant data are stored on computer systems; security-critical business processes are mapped to their digital pendants. This situation applies to various critical infrastructures requiring that different security requirements must be fulfilled. It demands a way to design and express higher-level security policies for such critical organizations. In this paper we focus on authorisation policies to demonstrate how software engineering techniques can help validate authorisation constraints and enforce access control policies. Our approach leverages features and functionalities of the UML\/OCL modeling methods as well as model driven approach to represent and specify authorisation model and constraints. Using our authorisation constraints editor, we articulate role-based authorisation policies. Also, we attempt to validate and enforce such constraints with the USE (UML Specification Environment) tool.<\/jats:p>","DOI":"10.1145\/1082983.1083215","type":"journal-article","created":{"date-parts":[[2005,11,7]],"date-time":"2005-11-07T19:28:32Z","timestamp":1131391712000},"page":"1-7","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Articulating and enforcing authorisation policies with UML and OCL"],"prefix":"10.1145","volume":"30","author":[{"given":"Karsten","family":"Sohr","sequence":"first","affiliation":[{"name":"Universit\u00e4t Bremen, Bremen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gail-Joon","family":"Ahn","sequence":"additional","affiliation":[{"name":"University of North Carolina at Charlotte, Charlotte, NC"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lars","family":"Migge","sequence":"additional","affiliation":[{"name":"Universit\u00e4t Bremen, Bremen, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2005,5,15]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"The RCL 2000 language for specifying role-based authorization constraints, Ph.D. thesis","author":"Ahn G.-J.","year":"1999","unstructured":"G.-J. Ahn , The RCL 2000 language for specifying role-based authorization constraints, Ph.D. thesis , George Mason University, Fairfax, Virginia , 1999 . G.-J. Ahn, The RCL 2000 language for specifying role-based authorization constraints, Ph.D. thesis, George Mason University, Fairfax, Virginia, 1999."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.5555\/647069.715953"},{"key":"e_1_2_1_3_1","volume-title":"Role Based Access Control","author":"American National Standards Institute Inc.","year":"2004","unstructured":"American National Standards Institute Inc. , Role Based Access Control , 2004 , ANSI-INCITS 359-2004. American National Standards Institute Inc., Role Based Access Control, 2004, ANSI-INCITS 359-2004."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/861998"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/501963.501966"},{"key":"e_1_2_1_6_1","volume-title":"Specification and Enforcement of Role-based Security Policies","author":"Migge L.","year":"2005","unstructured":"L. Migge , Specification and Enforcement of Role-based Security Policies , 2005 , Master Thesis , Universit\u00e4t Bremen . L. Migge, Specification and Enforcement of Role-based Security Policies, 2005, Master Thesis, Universit\u00e4t Bremen."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/990036.990054"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.5555\/993859"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.485845"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.5555\/794197.795068"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1066677.1066756"},{"key":"e_1_2_1_13_1","volume-title":"The Object Constraint Language: Getting your models ready for MDA","author":"Warmer J.","year":"2003","unstructured":"J. Warmer and A. Kleppe , The Object Constraint Language: Getting your models ready for MDA , Addison-Wesley , Reading\/ MA , 2003 . J. Warmer and A. Kleppe, The Object Constraint Language: Getting your models ready for MDA, Addison-Wesley, Reading\/MA, 2003."},{"key":"e_1_2_1_14_1","volume-title":"The MDA explained - the model driven architecture: Practice and promise","author":"Warmer J.","year":"2003","unstructured":"J. Warmer , A. Kleppe , and W. Bast , The MDA explained - the model driven architecture: Practice and promise , Addison-Wesley , Reading\/ MA , 2003 . J. Warmer, A. Kleppe, and W. Bast, The MDA explained - the model driven architecture: Practice and promise, Addison-Wesley, Reading\/MA, 2003."}],"container-title":["ACM SIGSOFT Software Engineering Notes"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1082983.1083215","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1082983.1083215","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T16:08:06Z","timestamp":1750262886000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1082983.1083215"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2005,5,15]]},"references-count":13,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2005,7]]}},"alternative-id":["10.1145\/1082983.1083215"],"URL":"https:\/\/doi.org\/10.1145\/1082983.1083215","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1083200.1083215","asserted-by":"subject"}]},"ISSN":["0163-5948"],"issn-type":[{"type":"print","value":"0163-5948"}],"subject":[],"published":{"date-parts":[[2005,5,15]]},"assertion":[{"value":"2005-05-15","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}