UMLsec is an extension to the
Unified Modeling Language
The Unified Modeling Language (UML) is a general-purpose, developmental modeling language in the field of software engineering that is intended to provide a standard way to visualize the design of a system.
The creation of UML was originally m ...
for integrating security related information in UML specifications. This information can be used for model-based
security engineering
Security engineering is the process of incorporating security controls into an information system so that the controls become an integral part of the system’s operational capabilities. It is similar to other systems engineering activities in tha ...
. Most security information is added using stereotypes and covers many security properties including
secure information flow,
confidentiality, and
access control
In the fields of physical security and information security, access control (AC) is the selective restriction of access to a place or other resource, while access management describes the process. The act of ''accessing'' may mean consuming ...
. Using an attacker model these properties can be checked on a model level.
Development
It was first proposed by Jürjens et al. in 2002 and later revised and extended by the same author.
Profile definition
UMLsec is defined as a lightweight extension for UML.
[OMG. Unified Modeling Language Superstructure version 2.2. The Object Management Group, February 2009. http://www.omg.org/spec/UML/2.2/Superstructure]
The profile is defined through a set of prototypes with properties (tag definitions) and constraints. UMLsec defines 21 stereotypes listed below.
Adversary model
To ensure security it is necessary to specify what kind of attacker is assumed. In UMLsec, the attacker model is defined through the threats that it poses. The table below defines the ''default'' adversary. Other adversaries may of course be defined.
{, class="wikitable"
, -
! Stereotype
! Threats
''default''()
, -
, Internet
, {delete, read, insert}
, -
, encrypted
, {delete}
, -
, LAN
, ∅
, -
, wire
, ∅
, -
, smart card
, ∅
, -
, POS device
, ∅
, -
, issuer node
, ∅
References
Unified Modeling Language