Executable Model-Based Risk Assessment Method for Identity Management Systems

Publication details

Part of: Policies and Research in Identity Management. Third IFIP WG 11.6 Working Conference, IDMAN 2013, London, UK, April 8-9, 2013. Proceedings (Springer, 2013)
Pages: 97–99–3
Year: 2013
Links:
- FULLTEKST: http://dx.doi.org/10.1007/978-3-642-37282-7_8
- DOI: doi.org/10.1007/978-3-642-37282-7_8

Currently, risk assessment methods for identity management systems (IDMSs) are lacking. This makes it difficult to compare IDMSs based on how they enhance privacy and security of system stakeholders. This article proposes the executable model-based risk assessment method (EM-BRAM) with the aim of addressing this challenge. The EM-BRAM identifies risk factors inherent in IDMSs and uses them as inputs to a colored petri nets (CPNs) model of a targeted IDMS. It then estimates or verifies the system’s security and privacy risks using CPNs’ state space analysis and queries.