Security policy conceptual modeling and formalization for networked information systems
Security in networked information systems is a very complex task that ranges from the level of crypto-primitives over crypto-protocols to the level of organizational matters and legislation. All this is comprised in a so-called security policy, which is often treated as an afterthought. One of the main reasons is the lack of appropriate techniques for conceptual modeling of security policy at early stages of system design. The approach in this paper is based on how controls as one of the key ingredients for defining a security policy. Consequent security services and security architectures are derived by means of the proposed technique, which also bridges thr gap to formal techniques. The result is a formalized output that serves as a basis for further refinement in subsequent stages of the modeling process. (C) 2000 Elsevier Science B.V. All rights reserved.
security policy conceptual modeling security architectures formal methods