An adaptive security model using agent-oriented MDA

Model-driven architecture (MDA) supports model-centred software development via successive model transformation. In MDA, the reusability of models is improved as well as the traceability of requirements. Agent-oriented model-driven architecture (AMDA) associates adaptive agents with a business-oriented interaction model and lets agents dynamically interpret their behaviour from the continuously maintained model via which the current business needs are deployed at runtime. The continuous re-interpretation rather than discrete re-transformation of models means immediate requirements deployment after re-configuration, no system down time being required to affect changes and results in a development process that is oriented to business experts rather than developers. Adopting the adaptive agent model, an AMDA paradigm, we put forward a security-aware model-driven mechanism by using an extension of the role-based access control (RBAC) model. For this purpose, the concept of agent role proposed in agent-oriented software engineering (AOSE) is integrated with the one proposed in RBAC. Agent duties are specified in an interaction model and describe the roles that agents can play to fulfil their functional responsibilities. Agent rights are specified in a security policy rule model attached to the interaction model and describe constraints upon agent capabilities caused by their associated social roles. The role-based interaction and policy-driven model incorporates both agent rights and duties. Hence, functional requirements and non-functional security constraint requirements are put together, related by the concept of role. Consequently, agents can continuously use the re-configurable model to play their roles in order to fulfil their responsibilities, and at the same time respect the security constraints. The major contribution from the approach is a method for building adaptive and secure MAS, following model-driven architecture. The approach is illustrated with an actual British railway management system.

[1]  Liang Xiao,et al.  An Adaptive Security Model for Multi-agent Systems and Application to a Clinical Trials Environment , 2007, 31st Annual International Computer Software and Applications Conference (COMPSAC 2007).

[2]  W. A. Jansen,et al.  MOBILE AGENTS AND SECURITY , 1999 .

[3]  Jan Jürjens,et al.  Model-based design and analysis of permission-based security , 2005, 10th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS'05).

[4]  A. Poggi,et al.  Multi-User and Security Support for Multi-Agent Systems , 2001, WOA.

[5]  Liang Xiao,et al.  Towards agent-oriented model-driven architecture , 2007, Eur. J. Inf. Syst..

[6]  Marian H. Nodine,et al.  A Metamodel for Agents, Roles, and Groups , 2004, AOSE.

[7]  Bo Luo,et al.  Adaptive Information: Improving Business through Semantic Interoperability, Grid Computing, and Enterprise Integration , 2005, Inf. Process. Manag..

[8]  David A. Basin,et al.  SecureUML: A UML-Based Modeling Language for Model-Driven Security , 2002, UML.

[9]  T. Mexia,et al.  Author ' s personal copy , 2009 .

[10]  Robert B. France,et al.  Model-driven development using UML 2.0: promises and pitfalls , 2006, Computer.

[11]  Bo Hu,et al.  Adaptive Agent Model: an Agent Interaction and Computation Model , 2007, 31st Annual International Computer Software and Applications Conference (COMPSAC 2007).

[12]  Mario Piattini,et al.  Access control and audit model for the multidimensional modeling of data warehouses , 2006, Decis. Support Syst..

[13]  G. G. Stokes.  "J." , 1890, The New Yale Book of Quotations.

[14]  Franco Zambonelli,et al.  Developing multiagent systems: The Gaia methodology , 2003, TSEM.

[15]  Andreas Schaad,et al.  An administration concept for the enterprise role-based access control model , 2003, SACMAT '03.

[16]  Richard F. Paige,et al.  Agile Security Using an Incremental Security Architecture , 2005, XP.

[17]  Charles J. Petrie,et al.  Service Agents and Virtual Enterprises: A Survey , 2003, IEEE Internet Comput..

[18]  Liang Xiao,et al.  Agent-oriented Requirements Modelling , 2005 .

[19]  Axel Korthaus,et al.  Using UML for Business Object Based Systems Modeling , 1997, UML Workshop.

[20]  M. Calisti,et al.  FOUNDATION FOR INTELLIGENT PHYSICAL AGENTS , 2000 .

[21]  Jan Jürjens,et al.  UMLsec: Extending UML for Secure Systems Development , 2002, UML.

[22]  Indrakshi Ray,et al.  Modeling Role-Based Access Control Using Parameterized UML Models , 2004, FASE.

[23]  Liang Xiao,et al.  A Hierarchical Agent-oriented Knowledge Model for Multi-Agent Systems , 2006, SEKE.

[24]  Desmond Greer,et al.  Externalisation and Adaptation of Multi-Agent System Behaviour , 2006 .

[25]  Manuel Resinas,et al.  A Model-Driven Architecture Approach for Modeling, Specifying and Deploying Policies in Autonomous and Autonomic Systems , 2006, 2006 2nd IEEE International Symposium on Dependable, Autonomic and Secure Computing.

[26]  Liang Xiao,et al.  Environment support for developing and configuring adaptive agents , 2009, Multiagent Grid Syst..

[27]  Liang Xiao,et al.  The adaptive agent model , 2006 .

[28]  Martin Schader,et al.  The Unified Modeling Language: Technical Aspects and Applications , 1999 .

[29]  Michael N. Huhns,et al.  Making Agents Secure on the Semantic Web , 2002, IEEE Internet Comput..

[30]  Bashar Nuseibeh,et al.  Weaving Together Requirements and Architectures , 2001, Computer.

[31]  Stefan Poslad,et al.  Towards improved trust and security in FIPA agent platforms , 2004 .

[32]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[33]  Anneke Kleppe,et al.  MDA explained - the Model Driven Architecture: practice and promise , 2003, Addison Wesley object technology series.

[34]  Martin Schader,et al.  The Unified Modeling Language , 1998, Physica-Verlag HD.

[35]  Mario Piattini,et al.  A BPMN Extension for the Modeling of Security Requirements in Business Processes , 2007, IEICE Trans. Inf. Syst..

[36]  Daniela E. Damian,et al.  Stakeholders in Global Requirements Engineering: Lessons Learned from Practice , 2007, IEEE Software.

[37]  José Luiz Fiadeiro,et al.  Designing for software's social complexity , 2007, Computer.

[38]  Liang Xiao,et al.  The Agent-Rule-Class framework for Multi-Agent Systems , 2006, Multiagent Grid Syst..

[39]  Mario Piattini,et al.  A UML 2.0/OCL Extension for Designing Secure Data Warehouses , 2005, J. Res. Pract. Inf. Technol..

[40]  Jan Jürjens,et al.  Towards a Comprehensive Framework for Secure Systems Development , 2006, CAiSE.

[41]  Leonid Sheremetov,et al.  An authentication protocol for agent platform security manager , 2003, EFTA 2003. 2003 IEEE Conference on Emerging Technologies and Factory Automation. Proceedings (Cat. No.03TH8696).