Aspects of Security
Lead Research Organisation:
Imperial College London
Department Name: Computing
Abstract
Good practice requires that security and other non-functional requirements are factored into a system design from the very start. In reality, the issues of legacy code and changing requirements due to changes in the regulatory or legislative framework require a more flexible approach. Security policies often have to be retro-fitted. The separation of concerns supported by aspect-oriented programming allows such retro-fitting without having to completely re-engineer the system.This proposal is for a series of short visits to the Danish Technical University to further advance joint work using aspects to enforce security policies on distributed, mobile systems.One main result from our past work is the integration of aspects into a coordination language that facilitates distribution of data, mobility of code, and the ability to work with dynamically evolving, open systems. We have applied this language to a case study based on electronic patient records for a small nursing home in Australia. We have shown how to encode the access control policies of this example and defined a new logic for verifying the correctness of such policies. The main outcomes from the planned series of visits are: a more sophisticated approach to aspect-oriented programming which includes dynamic program analysis; automation of the logic for reasoning about policies; further case studies; and extensions to the language.
Organisations
People |
ORCID iD |
| Chris Hankin (Principal Investigator) |
Publications
Hankin C
(2010)
Trustworthly Global Computing
Hankin C
(2009)
Advice from Belnap Policies
Yang F
(2013)
Predictive access control for distributed computation
in Science of Computer Programming
| Description | The funding was for overseas travel to support a series of visits to work with Professors Flemming Nielson and Hanne Riis Nielson at the Danish Technical University. After the award of the grant, the lab at DTU appointed me as a visiting professor and provided me with accomodation for two 1 month stays in the summers of 2009 and 2010 (and indeed 2011). I also made a number of shorter visits. As a consequence I have spent more time at DTU than originally envisaged but at a lower cost to the grant (because of fewer journeys and less accomodation costs). Our joint work has focussed on a formal model of access control in distributed systems. A motivating example was electronic healthcare systems. In such systems there are a number of different actors (patients, doctors, nurses) who create, access and modify records. The rules about who can do what, when and where are generally complex -- for example, doctors may be able to access any records but only update those of their own patients. We model the different entities as processes (each with an "address", or name, and the ability to own some data) and policies as rules which control what the process can do or have done to it. The rules are essentially aspects as in aspect-oriented programming. A lot of our initial work was devoted to resolving how to deal with potentially conflicting policies or incomplete policies. We developed a formal process algebra incorporating these ideas and a logic for reasoning about the overall policies in a system. Our more recent work has investigated the role of uncertainty -- introducing policies that are only applied with a certain probability. These can be used to model how actors cope with risk -- for example in bidding for and buying goods through an on-line auction. DTU have now recruited a PhD student who is studying how these ideas can be applied to understanding and developing the OASIS extensible Access Control Markup Language, XACML. I am continuing to be involved in this work and it may lead to some more realistic applications of our ideas. |
| Exploitation Route | We have recently submitted a proposal under the CERes call. The main topic of the proposal was Insider Threats but we expect to develop this access control work further under this programme. |
| Sectors | Digital/Communication/Information Technologies (including Software) |
| Description | The findings were published in peer review conferences and journals |
| First Year Of Impact | 2008 |
| Sector | Digital/Communication/Information Technologies (including Software) |
| Impact Types | Policy & public services |