Expressing Access Control Policies with an Event-Based Approach

Information systems are widely used and help in the management of huge quantities of data. Generally, these data are valuable or sensitive, their access must be restricted to granted users. Security is a mandatory requirement for information systems. Several methods already exist to express access control policies, but few of them support all kinds of constraints that can be defined in access control policies. In this paper, we present (EBSEC)-S-3, a language used to formally model and interpret access control policies in information systems. Permissions, prohibitions and static separation of duty arc specified by a class diagram. As (EBSEC)-S-3 includes a process algebra, dynamic access control constraints such as obligations and dynamic separation of duty can be easily expressed. Finally, we present the architecture of the tool used to interpret (EBSEC)-S-3 models.