Combining UML and B for the specification and validation of RBAC policies in business process activities

Integrating access control into business processes is a non-trivial task. This paper presents an approach that combines the UML and B languages for the specification and validation of RBAC policies at the process level. It starts by modeling the access control rules using our extension of UML2 activity diagrams denominated as BAAC@UML (Business Activity Access Control with UML). The BAAC@UML models are then translated into a specification in the B language using our B4MSecure platform. Finally, the last step validates the RBAC policy by testing its formal specification using the B tools (Provers and Animators).