Dynamic security rules for legacy systems

Industry 4.0 tries to digitalize the production process further. The digitalization is achieved by connecting different entities (machines, worker) to data-exchange, which needs to be dynamic and to adapt to different changing situations and members in the process. However, just exchanging data might lead to confidentiality issues. The data-exchange needs to be protected to secure the confidentiality and trust in the system. Therefore, security rules need to adapt to these dynamic situations. One part of a possible solution might be dynamic access control rules. However in many cases, existing "legacy" systems are reused, which can in not handle dynamic access control rules. Due to this gap between the required and provided functionality, we propose an approach, which integrates dynamic access control based on the system-context into legacy systems. Our approach uses a security adaption controller, which dynamically adapts the access control rules to a new situation and integrates them into an existing legacy system. We discussed our approach with industrial practitioners and related our approach to their existing legacy system. In addition, we performed a scalability analysis to demonstrate the applicability of our approach in a realistic environment.

• Publication year

  2019

• Venue

  European Conference on Software Architecture

• Publication date

  2019-09-09

• Fields of study

  Computer Science, Engineering

• Identifiers
  DOI 10.1145/3344948.3344974
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Data-Driven Software Architecture for Analyzing Confidentiality

  2019cited by this paper
• Dynamic Security Specification Through Autonomic Component Ensembles

  2018cited by this paper
• Coalition-OrBAC: An Agent-Based Access Control Model for Dynamic Coalitions

  2018cited by this paper
• Requirements and Specifications for Adaptive Security: Concepts and Analysis

  2018cited by this paper
• Towards Adaptive Access Control

  2018cited by this paper
• Modeling of dynamic trust contracts for industry 4.0 systems

  2018cited by this paper
• Attribute-Based Access Control

  2017cited by this paper
• Generative policy model for autonomic management

  2017cited by this paper
• Self-Adaptive Role-Based Access Control for Business Processes

  2017cited by this paper
• Software Abstractions for Component Interaction in the Internet of Things

  2016cited by this paper
• Modeling and Simulating Software Architectures: The Palladio Approach

  2016cited by this paper
• Deductive Software Verification – The KeY Book

  2016cited by this paper
• Runtime Model-Based Privacy Checks of Big Data Cloud Services

  2015influential reference
• Context Aware Middleware Architectures: Survey and Challenges

  2015cited by this paper
• A policy-based middleware for context-aware pervasive computing

  2015cited by this paper
• Role-Based Access Control ( RBAC ) : Features and Motivations

  2014influential reference
• Self-adaptive federated authorization infrastructures

  2014cited by this paper
• Checking probabilistic noninterference using JOANA

  2014cited by this paper
• Modeling rock weathering in small watersheds

  2014cited by this paper
• Modeling and enforcing secure object flows in process-driven SOAs: an integrated model-driven approach

  2012cited by this paper
• Modeling and Enforcing Secure Object Flows in Process-driven SOAs: An Integrated Model-driven Approach

  2012cited by this paper
• A Framework for Context-Aware Applications for Smart Spaces

  2011cited by this paper
• Deductive software verification

  2011cited by this paper
• A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management

  2010cited by this paper
• Threat Modeling

  2004cited by this paper
• Organization based access control

  2003cited by this paper
• Modelling contexts in the Or-BAC model

  2003cited by this paper
• Dynamic context-aware access control for grid applications

  2003cited by this paper
• The Vision of Autonomic Computing

  2003cited by this paper
• UMLsec: Extending UML for Secure Systems Development

  2002cited by this paper
• Dynamic access control through Petri net workflows

  2000cited by this paper
• Role-Based Access Control (RBAC): Features and Motivations | NIST

  1995cited by this paper

• Zero Trust Implementation for Legacy Systems using Dynamic Microsegmentation, Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC)

  2025cites this paper
• Integration of Legacy Industrial Equipment in a Building-Management System Industry 5.0 Scenario

  2024cites this paper
• Ensemble-Based Modeling Abstractions for Modern Self-optimizing Systems

  2023cites this paper
• Architecture-based attack propagation and variation analysis for identifying confidentiality issues in Industry 4.0

  2023influential citation
• Machine-learning abstractions for component-based self-optimizing systems

  2023cites this paper
• ML-DEECo: a Machine-Learning-Enabled Framework for Self-organizing Components

  2022cites this paper
• Dynamic Access Control in Industry 4.0 Systems

  2022influential citation
• Modernization Framework to Enhance the Security of Legacy Information Systems

  2022cites this paper
• Identifying Confidentiality Violations in Architectural Design Using Palladio (short paper)

  2021cites this paper
• Detecting violations of access control and information flow policies in data flow diagrams

  2021cites this paper
• Context-Based Confidentiality Analysis for Industrial IoT

  2020cites this paper
• Malicious changeload for the resilience evaluation of self-adaptive authorisation infrastructures

  2020cites this paper
• Capturing Dynamicity and Uncertainty in Security and Trust via Situational Patterns

  2020cites this paper
• Context-based confidentiality analysis in dynamic Industry 4.0 scenarios

  2019cites this paper