Hierarchical RBAC design class model

The metamodel for RBAC.
Specurity Aspects
Name
Description
create scenarios that must be labeled as legal or illegal
Specification Elements
Name
Description
The user who interacts with the system.
The collection of roles a user has in a given context.
Determines the resources that the user can access in the session.
Describes RBAC permissions in terms of operations that can be performed on targets
The object an operation can be performed on.
The action performed on a target.

  • Security Aspects

    • scenario generation

      create scenarios that must be labeled as legal or illegal
      Specification Elements:
      User
      Session
      Role
      Permission
      Target
      Operation
      Threats:
      Spoofing
      Tampering with Data
      Information Disclosure
      Elevation of Privileges

    Specification Elements

    • User

      The user who interacts with the system.
      Applies to:
      Entity

    • Session

      The collection of roles a user has in a given context.
      Applies to:
      State

    • Role

      Determines the resources that the user can access in the session.
      Applies to:
      Entity

    • Permission

      Describes RBAC permissions in terms of operations that can be performed on targets
      Applies to:
      State

    • Target

      The object an operation can be performed on.
      Applies to:
      Entity
      Data

    • Operation

      The action performed on a target.
      Applies to:
      Activity