Security assurance for an RBAC/MAC security model

Corporations and government agencies rely on inter-operating software artifacts (e.g., legacy, COTS, GOTS, databases, servers, etc.) and client applications, brought together by middleware (e.g., CORBA, JINI, NET, etc.), supporting unrestricted access to application programmer interfaces, APIs. As part of our ongoing research, we have designed and prototyped a unified role-based/mandatory access control (RBAC/MAC) security model with delegation and enforcement to control access by users (via clients) to the methods of artifact APIs, namely: who (user/client) can invoke which methods of artifact APIs at what times. Underlying our RBAC/MAC framework are security assurance rules, SARs, which provide a confidence level on the attainment of an application's security policy. In this paper, we focus on the formal underpinnings of our security assurance research, its realization during security policy definition with management tools, and at runtime by the enforcement framework.