A Case Study in Access Control Requirements for a Health Information System

MP Evered; SF Bogeholz

A Case Study in Access Control Requirements for a Health Information System

MP Evered
, SF Bogeholz

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

We present a detailed examination of the access constraints for a small real-world Health Information System with the aim of achieving minimal access rights for each of the involved principals. We show that, even for such a relatively simple system, the resulting constraints are very complex and cannot be expressed easily or clearly using the static per-method access control lists generally supported by component-based software. We derive general requirements for the expressiveness of access constraints and propose criteria for a more suitable access control mechanism in the context of component-based systems. We describe a two-level mechanism which can fulfil these criteria.

Original language	English
Title of host publication	Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32
Editors	Hogan, J, Montague, P, Purvis, M, Steketee, C
Place of Publication	Dunedin, New Zealand
Publisher	Australian Computer Society (ACS)
Pages	53-61
ISBN (Print)	1920682147
Publication status	Published - 2004
Event	AISW 2004: Second Australasian Information Security Workshop - Dunedin, New Zealand Duration: 31 Jan 2004 → …

Conference

Conference	AISW 2004: Second Australasian Information Security Workshop
City	Dunedin, New Zealand
Period	31/01/04 → …

Keywords

Computer Software

Access to Document

https://hdl.handle.net/1959.11/1012

Handle.net

Persistent link

Cite this

Evered, MP., & Bogeholz, SF. (2004). A Case Study in Access Control Requirements for a Health Information System. In Hogan, J, Montague, P, Purvis, M, Steketee, & C (Eds.), Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32 (pp. 53-61). Australian Computer Society (ACS). https://hdl.handle.net/1959.11/1012

Evered, MP ; Bogeholz, SF. / A Case Study in Access Control Requirements for a Health Information System. Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32. editor / Hogan ; J ; Montague ; P ; Purvis ; M ; Steketee ; C. Dunedin, New Zealand : Australian Computer Society (ACS), 2004. pp. 53-61

@inproceedings{6019df922dec45d681eec954d1914b3f,

title = "A Case Study in Access Control Requirements for a Health Information System",

abstract = "We present a detailed examination of the access constraints for a small real-world Health Information System with the aim of achieving minimal access rights for each of the involved principals. We show that, even for such a relatively simple system, the resulting constraints are very complex and cannot be expressed easily or clearly using the static per-method access control lists generally supported by component-based software. We derive general requirements for the expressiveness of access constraints and propose criteria for a more suitable access control mechanism in the context of component-based systems. We describe a two-level mechanism which can fulfil these criteria.",

keywords = "Computer Software",

author = "MP Evered and SF Bogeholz",

year = "2004",

language = "English",

isbn = "1920682147",

pages = "53--61",

editor = "Hogan and J and Montague and P and Purvis and M and Steketee and C",

booktitle = "Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32",

publisher = "Australian Computer Society (ACS)",

note = "AISW 2004: Second Australasian Information Security Workshop ; Conference date: 31-01-2004",

}

Evered, MP & Bogeholz, SF 2004, A Case Study in Access Control Requirements for a Health Information System. in Hogan, J, Montague, P, Purvis, M, Steketee & C (eds), Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32. Australian Computer Society (ACS), Dunedin, New Zealand, pp. 53-61, AISW 2004: Second Australasian Information Security Workshop, Dunedin, New Zealand, 31/01/04. <https://hdl.handle.net/1959.11/1012>

A Case Study in Access Control Requirements for a Health Information System. / Evered, MP; Bogeholz, SF.
Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32. ed. / Hogan; J; Montague; P; Purvis; M; Steketee; C. Dunedin, New Zealand: Australian Computer Society (ACS), 2004. p. 53-61.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A Case Study in Access Control Requirements for a Health Information System

AU - Evered, MP

AU - Bogeholz, SF

PY - 2004

Y1 - 2004

N2 - We present a detailed examination of the access constraints for a small real-world Health Information System with the aim of achieving minimal access rights for each of the involved principals. We show that, even for such a relatively simple system, the resulting constraints are very complex and cannot be expressed easily or clearly using the static per-method access control lists generally supported by component-based software. We derive general requirements for the expressiveness of access constraints and propose criteria for a more suitable access control mechanism in the context of component-based systems. We describe a two-level mechanism which can fulfil these criteria.

AB - We present a detailed examination of the access constraints for a small real-world Health Information System with the aim of achieving minimal access rights for each of the involved principals. We show that, even for such a relatively simple system, the resulting constraints are very complex and cannot be expressed easily or clearly using the static per-method access control lists generally supported by component-based software. We derive general requirements for the expressiveness of access constraints and propose criteria for a more suitable access control mechanism in the context of component-based systems. We describe a two-level mechanism which can fulfil these criteria.

KW - Computer Software

UR - http://www.cis.unisa.edu.au/aisw04/

UR - http://portal.acm.org/citation.cfm?id=976447

UR - http://crpit.com/confpapers/CRPITV32Evered.pdf

M3 - Conference contribution

SN - 1920682147

SP - 53

EP - 61

BT - Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32

A2 - Hogan, null

A2 - J, null

A2 - Montague, null

A2 - P, null

A2 - Purvis, null

A2 - M, null

A2 - Steketee, null

A2 - C, null

PB - Australian Computer Society (ACS)

CY - Dunedin, New Zealand

T2 - AISW 2004: Second Australasian Information Security Workshop

Y2 - 31 January 2004

ER -

Evered MP, Bogeholz SF. A Case Study in Access Control Requirements for a Health Information System. In Hogan, J, Montague, P, Purvis, M, Steketee, C, editors, Proceedings of the Second Australasian Information Security Workshop (AISW2004) - Conferences in Research and Practice in Information Technology, Vol. 32. Dunedin, New Zealand: Australian Computer Society (ACS). 2004. p. 53-61

A Case Study in Access Control Requirements for a Health Information System

Abstract

Conference

Keywords

Access to Document

Handle.net

Fingerprint

Cite this