Verification of an Integrated Role-Based Access Control Model

Role-based access control (RBAC) has been acknowledged as an effective mechanism for specifying and enforcing access control policies. However, it is not always clear how an RBAC policy can be systematically integrated into the system design so as to preserve the desired security requirements. In this paper we propose a representation and a process that supports systematic integration of an access control policy into the system design. The integrated design process uses a single notation, called Behavior Trees (BT), for specifying both the RBAC policy and the system design. Furthermore, the same notation is used for formal verification of both the RBAC policy and the system design. We also present strategies and challenges for automated translation of the extended BT notation required for specifying an RBAC policy.