Seamless Secure Development of Systems: From Modeling to Enforcement of Access Control Policies

Despite the emphasis on removing gap between software models and implementation code, there has been made little effort to apply software tools to enforce access control models directly into program code. In this paper the design and implementation of an access control policy enforcement environment is described. Within this environment, view-based access control policies defined in XML Metadata Interchange format are translated into view policy language. The view policy language primitives are then easily translated into Java primitives. At last, these primitives are enforced into Java program code to be secured. Two major benefits of applying the proposed approach for modeling and enforcement of access control policies are rapid development of view-based customized applications and secure enforcement of ordered chain of methods´ executions.