Modeling Access Control Requirements in Feature Model

Access control requirements (ACRs) are software requirements about limiting privileges of users from accessing sensitive software resources. ACRs often interact with functional requirements (FRs), conform to an access control model, are constrained by authorization constraints of organizations, and change frequently. Current requirements modeling technologies, such as use case modeling approaches, object-oriented analysis, and feature-oriented approaches, are initially designed to model FRs, and cannot explicitly and efficiently model the ACRs. In real world, it is still very difficult for the developers to model and evolve the complex and changeful ACRs of large-scale software applications while ensuring the consistency between ACRs and FRs. This paper analyzes the challenges of modeling ACRs, presents a feature-based approach to modeling the ACRs to overcome them, and illustrates the approach in an online store application.