Towards Automatic Integration Of Or-BAC Security Policies Using Aspects

Yliès Falcone (1) , Mohamad Jaber (2)

1 VERTECS - Verification models and techniques applied to testing and control of reactive systems
2 VERIMAG - IMAG - VERIMAG

We propose a formal method to automatically integrate security rules regarding an access control policy (expressed in Or-BAC) in Java programs. Given an untrusted application and a set of Or-BAC security rules, our method derives corresponding AspectJ aspects. Derived aspects modify the behaviour of the underlying program so as to meet the policy. Then, these aspects are weaved into the target program (using the AspectJ compiler). The result is a trusted program on which the security policy is enforced. This approach was applied in order to secure the behaviour of a travel agency application.

Mots clés: Security policy; Or-BAC; Aspect Oriented Programming; AspectJ

Domaines: Génie logiciel [cs.SE]

Yliès Falcone, Mohamad Jaber. Towards Automatic Integration Of Or-BAC Security Policies Using Aspects. International Conference on Software Engineering Research and Practice (SERP 2010), Jul 2010, Las Vegas, Nevada, United States. pp.5. ⟨hal-00525490⟩