Automated Reviewing of Healthcare Security Policies - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2013

Automated Reviewing of Healthcare Security Policies

Résumé

We present a new formal validation method for healthcare security policies in the form of feedback-based queries to ensure an answer to the question of Who is accessing What in Electronic Health Records. To this end, we consider Role-based Access Control (RBAC) that offers the flexibility to specify the users, roles, permissions, actions, and the objects to secure. We use the Z notation both for formal specification of RBAC security policies and for queries aimed at reviewing these security policies. To ease the effort in creating the correct specification of the security policies, RBAC-based graphical models (such as SecureUML) are used and automatically translated into the corresponding Z specifications. These specifications are then animated using the Jaza tool to execute queries against the specification of security policies. Through this process, it is automatically detected who will gain access to the medical record of the patient and which information will be exposed to that system user.

Dates et versions

hal-00857283 , version 1 (03-09-2013)

Identifiants

Citer

Nafees Qamar, Johannes Faber, Yves Ledru, Zhiming Liu. Automated Reviewing of Healthcare Security Policies. FHIES 2012 - 2nd International Symposium on the Foundations of Health Information Engineering and Systems, Aug 2012, Paris, France. pp.176-193, ⟨10.1007/978-3-642-39088-3_12⟩. ⟨hal-00857283⟩
155 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More