Abstract

We show how UML (the industry standard in object-oriented modelling) can be used to express security requirements during system development. Using the extension mechanisms provided by UML, we incorporate standard concepts from formal methods regarding multi-level secure systems and security protocols. These definitions evaluate diagrams of various kinds and indicate possible vulnerabilities.

Citations

1040	Private Authentication - Abadi - 2003
791	Booh G: The Unified Modeling Language Reference Manual - Rumbaugh, Jacobson - 1999
619	Security Policy and Security Models - Goguen, Meseguer - 1982
252	Why cryptosystems fail - Anderson - 1994
98	Software engineering for security: A roadmap - Devanbu, Stubblebine - 2000
94	The uml as a formal modelling notation - Evans, France, et al.
88	Formal eavesdropping and its computational interpretation - Abadi, Jürjens - 2001
87	Specification and Development of Interactive Systems - Broy, Stølen - 2001
62	Noninterference through determinism - Roscoe, Woodcock, et al. - 1994
61	Breaking and the Needham-Schroeder public-key protocol using FDR - Lowe - 1996
39	Security Protocols and their Properties - Abadi - 2000
39	Transport Layer Security: How much does it really cost - Apostolopoulos, Peris, et al. - 1999
37	State diagrams in UML: A formal semantics using graph transformations - Gogolla, Parisi-Presicce - 1998
31	Analysing UML active classes and associated state machines – A lightweight formal approach - Reggio, Astesiano, et al. - 2000
17	Using UML - Stevens, Pooley - 2000
14	Formalism and method - Astesiano, Reggio - 1997
13	Principles for Secure Systems Design - Jürjens - 2002
10	Secrecy-preserving re - Jurjens - 2001
6	Secure information for concurrent processes - Jurjens - 2000
5	An Algebraic Semantics of UML Supporting its Multiview Approach - Reggio, Cerioli, et al. - 2000
3	Object-oriented modelling of audit security for smart-card payment schemes - Jurjens - 2001
2	Using relational and behavioural semantics in the veri of object models - Bolton, Davies - 2000
2	B -- Message Sequence Chart Algebraic Semantics - 120 - 1995
1	Formale Beschreibungstechniken und praktische Softwaretechnik { eine ungluckliche Verbindung - Humann - 1999
1	Formal speci of object-oriented meta-modelling. In FASE2000, volume 1783 of LNCS - unknown authors - 2000