The software security issue is being paid great attention from the software development community as security violations have emerged variously. Developers often use access control techniques to restrict some security breaches to software systems’ resources. The addition of authorization constraints to the role-based access control model increases the ability to express access rules in real-world problems. However, the complexity of combining components, libraries and programming languages during the implementation stage of web systems’ access control policies may arise potential flaws that make applications’ access control policies inconsistent with their specifications. In this paper, we introduce an approach to review the implementation of these models in web applications written by Java EE according to the MVC architecture under the support of the Spring Security framework. The approach can help developers in detecting flaws in the assignment implementation process of the models. First, the approach focuses on extracting the information about users and roles from the database of the web application. We then analyze policy configuration files to establish the access analysis tree of the application. Next, algorithms are introduced to validate the correctness of the implemented user-role and role-permission assignments in the application system. Lastly, we developed a tool called VeRA, to automatically support the verification process. The tool is also experimented with a number of access violation scenarios in the medical record management system.

中文翻译：

---

VerA：验证 Web 应用程序的 RBAC 和授权约束模型

软件安全问题正受到软件开发界的高度关注，安全违规行为层出不穷。开发人员经常使用访问控制技术来限制对软件系统资源的某些安全漏洞。向基于角色的访问控制模型添加授权约束增加了在现实问题中表达访问规则的能力。然而，在 Web 系统访问控制策略的实施阶段，组合组件、库和编程语言的复杂性可能会产生潜在的缺陷，使应用程序的访问控制策略与其规范不一致。在本文中，我们介绍了一种方法，在 Spring Security 框架的支持下，根据 MVC 架构，在 Java EE 编写的 Web 应用程序中审查这些模型的实现。该方法可以帮助开发人员检测模型分配实现过程中的缺陷。首先，该方法侧重于从 Web 应用程序的数据库中提取有关用户和角色的信息。然后我们分析策略配置文件来建立应用程序的访问分析树。接下来，引入算法来验证应用系统中实现的用户角色和角色权限分配的正确性。最后，我们开发了一个名为 该方法侧重于从 Web 应用程序的数据库中提取有关用户和角色的信息。然后我们分析策略配置文件来建立应用程序的访问分析树。接下来，引入算法来验证应用系统中实现的用户角色和角色权限分配的正确性。最后，我们开发了一个名为 该方法侧重于从 Web 应用程序的数据库中提取有关用户和角色的信息。然后我们分析策略配置文件来建立应用程序的访问分析树。接下来，引入算法来验证应用系统中实现的用户角色和角色权限分配的正确性。最后，我们开发了一个名为维拉, 自动支持验证过程。该工具还在病历管理系统中对许多访问违规场景进行了试验。