UMLsec: Extending UML for secure systems development

Abstract

Developing secure-critical systems is difficult and there are many well-known examples of security weaknesses exploitedin practice. Thus a sound methodology supporting secure systems development is urgently needed. Our aim is to aid the difficult task of developing security-critical systems in an approach basedon the notation of the UnifiedModeling Language. We present the extension UMLsec of UML that allows to express security-relevant information within the diagrams in a system specification. UMLsec is defined in form of a UML profile using the standard UML extension mechanisms. In particular, the associatedconstraints give criteria to evaluate the security aspects of a system design, by referring to a formal semantics of a simplifiedfragment of UML. We demonstrate the concepts with examples. © Springer-Verlag Berlin Heidelberg 2002.