Model Driven Security Management: Making Security Management Manageable in Complex Distributed Systems

Ulrich Lang, Rudolf Schreiner
2008 ACM/IEEE International Conference on Model Driven Engineering Languages and Systems  
Today, the challenge in security of complex distributed systems does not anymore lie in encryption or access control of a single middleware platform, but in the protection of the system as a whole. This includes the definition of correct security policies at various abstraction layers, and also in the unified and correct management and enforcement of the correct security policy at all relevant places in the system. The authors have learned in the development even of comparatively simple
more » ... ted systems that this is not possible anymore by a manual definition of encryption properties and access control rules. Human security administrators are not able to define all these fine grained rules with sufficient assurance, to distribute them to all Policy Enforcement Points and to check many log files or admin consoles. This is especially impossible in highly distributed and agile service oriented or data driven systems. In this paper we will illustrate the approach and architecture behind Model Driven Security Management and provide a healthcare regulatory compliance case study using our OpenPMF 2.0 technology.
dblp:conf/models/LangS08 fatcat:4otdhas2gndwnp6y4fkify2dom