Theses and Dissertations Collection

Society relies on the connections between information systems and, as need for these interconnected systems has grown, so has the system complexity. Modern system security can prove difficult; fully understanding the interactions of the system’s components is both technically intensive and time consuming. System security policy managers require a method by which they may clearly operate on system access security policies. This thesis describes a formal model for policy abstraction in a role-based access controlled environment, combination of multiple policies, and abstracted reconstruction of policy artifacts in this environment. This work contributes: formal role-based access control policy modeling, formal policy composition, and policy file reconstruction. This thesis demonstrates the applicability of the Hierarchical Security Policy model to role-based access control systems, capability to compose security policies from disparate sources, and capability to maintain enough information to permit modification and redeployment of security policy artifacts.