A. Diala, . Haidar, C. Nora, C. Frederic, and D. Herve, 13 ? Diagramme de séquence utilisé pour l'orchestration des composantes du profil OrBAC Bibliographie [1] An extended RBAC profile of XACML, Proceedings of the 3rd ACM workshop on Secure web services, SWS '06, pp.13-22, 2006.

A. Jean-raymond, The B-Book : Assigning Programs to Meanings, 1996.

A. Jean-raymond, Modeling in Event-B : System and Software Engineering, 2009.

A. Muhammad, H. Michael, and B. Ruth, A constraint based role based access control in the SECTET a model-driven approach, 2006.

A. Christopher, D. Michael, F. Ute, S. Karsten, and W. Ruben, A Classification Framework Designed for Advanced Role-based Access Control Models and Mechanisms, 2009.

A. Anderson and . Xacml, Profile for Role Based Access Control (RBAC) . OASIS Standard, 2004.

D. Basin, J. Doser, and T. Lodderstedt, Model driven security, ACM Transactions on Software Engineering and Methodology, vol.15, issue.1, pp.39-91, 2006.
DOI : 10.1145/1125808.1125810

B. David, O. Ernst-ruediger, E. Paul, and . Sevinc, Specifying and analyzing security automata using CSP-OZ, Proceedings of the 2nd ACM symposium on Information, computer and communications security, ASIACCS '07, pp.70-81, 2007.

D. A. Basin, J. Samuel, . Burri, K. Günter, B. Michael et al., Dynamic Enforcement of Abstract Separation of Duty Constraints, ESORICS Lecture Notes in Computer Science, vol.2, issue.1, pp.250-267, 2009.
DOI : 10.1145/300830.300837

D. Bell and L. Lapadula, Secure Computer Systems : Mathematical Foundations and Model, pp.74-24442, 1973.

B. Nazim, La composition des protocoles de sécurité avec la méthode B ´ evénementielle, Thèse de doctorat, Laboratoire Lorrain de Recherche en Informatique et ses Applications, 2010.

B. Elisa, P. Andrea, B. Elena, and F. , TRBAC : A temporal rolebased access control model, ACM Trans. Inf. Syst. Secur, vol.4, pp.191-233, 2001.

B. Elisa, C. Barbara, F. Elena, and P. Paolo, A logical framework for reasoning about access control models, Proceedings of the sixth ACM symposium on Access control models and technologies, SACMAT '01, pp.41-52, 2001.

B. Tommaso and B. Ed, Introduction to the ISO specification language LOTOS, Comput. Netw. ISDN Syst, vol.14, issue.1, pp.25-59, 1987.

B. Jery, Reasoning about XACML policies using CSP, Proceedings of the 2005 workshop on Secure web services, SWS '05, pp.28-35, 2005.

L. Cholvy and F. Cuppens, Analyzing consistency of security policies, Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097), pp.103-112, 1997.
DOI : 10.1109/SECPRI.1997.601324

D. David, D. R. Clark, and . Wilson, A Comparison of Commercial and Military Computer Security Policies . Security and Privacy, IEEE Symposium on, p.184, 1987.

C. Jason and K. Hemanth, XACML and role-based access control, Presentation at DIMACS Workshop on Security of Web Services and e-Commerce, p.174, 2005.

C. Fredéric, C. Nora, and C. Céline, MotOrBAC : un outil d'administration et de simulation de politiques de sécurité, Security in Network Architectures (SAR) and Security of Information Systems (SSI), First Joint Conference, 2006.

E. B. Fernandez, A methodology for secure software design . Dans Procs, Int. Conf. on Software Engineering Research and Practice, pp.21-24, 2004.

F. David, D. Ferraiolo, K. Richard, and C. Ramaswamy, Role-Based Access Control, 2003.

B. Fraikin, M. Jim, W. , J. Song, and D. , Efficient Symbolic Execution of Large Quantifications in a Process Algebra, LNCS, vol.4789, pp.327-344, 2007.
DOI : 10.1007/978-3-540-76650-6_19

F. Benoit and F. Marc, Efficient Symbolic Computation of Process Expressions, Science of Computer Programming, vol.74, issue.9, pp.723-753, 2009.

M. Frappier, B. Fraikin, F. Gervais, R. Laleau, and M. Richard, Synthesizing Information Systems : the APIS Project, First International Conference on Research Challenges in Information Science, pp.73-84, 2007.
URL : https://hal.archives-ouvertes.fr/hal-01125305

M. Frappier, F. Gervais, R. Laleau, B. Fraikin, and R. St-denis, Extending statecharts with process algebra operators, Innovations in Systems and Software Engineering, pp.285-292, 2008.
DOI : 10.1007/s11334-008-0064-1
URL : https://hal.archives-ouvertes.fr/hal-01223276

M. Frappier and R. St-denis, EB 3 : an entity-based black-box specification method for information systems, Software and System Modeling, pp.134-149, 2003.

F. Gervais, M. Frappier, and R. Laleau, Generating relational database transactions from eb 3 attribute definitions, Software & Systems Modeling, vol.18, issue.2, pp.423-445, 2009.
DOI : 10.1007/s10270-008-0104-1
URL : https://hal.archives-ouvertes.fr/hal-01224655

G. Dimitar, R. Mark, and S. Pierre, Model-Checking Access Control Policies

C. Gutierrez, E. Fernandez-medina, and M. Piattini, PWSSec: Process for Web Services Security, 2006 IEEE International Conference on Web Services (ICWS'06), pp.213-222, 2006.
DOI : 10.1109/ICWS.2006.107

G. Carlos, F. Eduardo, . Fern´andez-medina, and P. Mario, Towards a Process for Web Services Security, Journal of Research and Practice in Information Technology, vol.38, issue.1, 2006.

M. A. Harrison, W. L. Ruzzo, and J. D. Ullman, Protection in operating systems, Communications of the ACM, vol.19, issue.8, pp.461-471, 1976.
DOI : 10.1145/360303.360333

T. Son, H. David, B. Jean-raymond, and A. , Specifying Access Control in Event-B, 2009.

C. A. Hoare, Communicating sequential processes, Communications of the ACM, vol.21, issue.8, pp.666-677, 1978.
DOI : 10.1145/359576.359585

M. Ibm, Security in a Web Services World : A Proposed Architecture and Roadmap Version 1.0 . IBM, Microsoft, 2002.

J. Sushil, S. Pierangela, M. Luisa, S. , and V. S. Subrahmanian, Flexible support for multiple access control policies, ACM Trans. Database Syst, vol.26, pp.214-260, 2001.

B. James, E. Joshi, . Bertino, and G. Arif, Temporal hierarchies and inheritance semantics for GTRBAC, Proceedings of the seventh ACM symposium on Access control models and technologies, SACMAT '02, pp.74-83, 2002.

A. Abou-el and K. , Modèles et politiques de sécurité pour les domaines de la santé et des affaires sociales, Thèse de doctorat, Laboratoire d'Analyse et d Architecture des Systèmes du Centre National de la Recherche Scientifique, 2003.

A. Abou-el, K. Salem, B. Alexandre, M. Egemi-`-mi-`-ege, R. El et al., Organization based access control, Proceedings of the 4th IEEE International Workshop on Policies for Distributed Systems and Networks, POLICY '03, pp.120-130
URL : https://hal.archives-ouvertes.fr/hal-01483818

K. Slim, C. Anis, M. Mira, J. Mohamed, and K. Karl, From Formal Access Control Policies to Runtime Enforcement Aspects, Proceedings of the 1st International Symposium on Engineering Secure Software and Systems, ESSoS '09, pp.16-31, 2009.

K. Vladimir, H. James, and P. Bijan, Analyzing web access control policies, Proceedings of the 16th international conference on World Wide Web, pp.677-686, 2007.

P. Konopacki, Synthèse automatique de gardes EB3, 2008.

K. Pierre, F. Marc, L. Régine, S. Camille, P. Oscar et al., Expressing Access Control Policies with an Event-Based Approach Advanced Information Systems Engineering Workshops, Lecture Notes in Business Information Processing, vol.83, pp.607-621, 2011.

L. Yves, I. Akram, M. Jeremy, Q. Nafees, L. Regine et al., Taking into Account Functional Models in the Validation of IS Security Policies, 1st International Workshop on Information Systems Security Engineering (WISSE) host by CAISE, 2011.

L. Yves, Q. Nafees, I. Akram, R. Jean-luc, L. Mohamed-amine et al., Validation of security policies by the animation of Z specifications, pp.155-164, 2011.

L. Ninghui and W. Qihua, Beyond separation of duty : An algebra for specifying highlevel security policies, J. ACM, vol.55, issue.3, pp.1-46, 2008.

L. Torsten, D. A. Basin, and D. Jürgen, SecureUML : A UML-Based Modeling Language for Model-Driven Security, Proceedings of the 5th International Conference on The Unified Modeling Language, UML '02, pp.426-441, 2002.

M. Mankai and L. Logrippo, Access Control Policies : Modeling and Validation, NOTERE, pp.85-91, 2005.

M. Alexandre and . Ege, Définition d'un environnement formel d'expression de politiques de sécurité. Modèle Or-BAC et extensions, Thèse de doctorat, 2005.

J. Milhau, B. Fraikin, and M. Frappier, Automatic Generation of Error Messages for the Symbolic Execution of EB 3 Process Expressions, 7th International Conference, IFM 2009 Proceedings, volume 5423 de LNCS, pp.337-351, 2009.

J. Milhau, A. Idani, R. Laleau, M. Labiadh, Y. Ledru et al., Combining UML, ASTD and B for the formal specification of an access control filter, Innovations in Systems and Software Engineering, pp.303-313, 2011.
DOI : 10.1007/s11334-011-0166-z
URL : https://hal.archives-ouvertes.fr/hal-00860798

N. Anthony, K. Chris, M. Ronald, and H. Phillip, Web Services Security : SOAP Message Security 1.1 (WS-Security OASIS Standard, 2004.

N. Qun, E. Bertino, and L. Jorge, An obligation model bridging access control policies and privacy policies, Proceedings of the 13th ACM symposium on Access control models and technologies, SACMAT '08, pp.133-142, 2008.

P. Jaehong and S. Ravi, Towards usage control models : beyond traditional access control, Proceedings of the seventh ACM symposium on Access control models and technologies, SACMAT '02, pp.57-64, 2002.

R. Prathima, L. Dan, B. Elisa, L. Ninghui, L. Jorge et al., An algebra for fine-grained integration of XACML policies, pp.63-72, 2009.

R. Indrakshi, L. Na, F. Robert, and K. Dae-kyoo, Using uml to visualize rolebased access control constraints, Proceedings of the ninth ACM symposium on Access control models and technologies, SACMAT '04, pp.115-124, 2004.

R. Robert, Système d'information et management des organisations, Vuibert, 1998.

A. W. Roscoe, J. C. Woodcock, and L. Wulf, A CSP formulation of noninterference, European Symposium on Research in Computer Security, pp.33-35

R. Sandhu, Transaction control expressions for separation of duties, [Proceedings 1988] Fourth Aerospace Computer Security Applications, pp.282-286, 1988.
DOI : 10.1109/ACSAC.1988.113349

R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman, Role-based access control models, Computer, vol.29, issue.2, pp.38-47, 1996.
DOI : 10.1109/2.485845

S. Paul and O. Mike, Sarbanes-Oxley Act, Public Law, issue.116, pp.107-204, 2002.

S. Andreas and J. D. Moffett, A lightweight approach to specification and analysis of role-based access control extensions, Proceedings of the seventh ACM symposium on Access control models and technologies, SACMAT '02, pp.13-22, 2002.

S. Jeffrey, Web Services Policy Framework (WSPolicy) Version 1.2, 2006.

E. Gün, S. Ke, and W. , An access control language for web services, SACMAT '02 : Proceedings of the seventh ACM symposium on Access control models and technologies, pp.23-30, 2002.

S. Enéraleen´enérale, Note explicative concernant la la fraude exceptionnelle, 2008.

S. Karsten, D. Michael, A. Gail-joon, and G. Martin, Analyzing and Managing Role-Based Access Control Policies, IEEE Transactions on Knowledge and Data Engineering, vol.20, pp.924-939, 2008.

J. M. Spivey, The Z notation : a reference manual, 1992.

K. Roshan and . Thomas, Team-based access control (TMAC) : a primitive for applying rolebased access controls in collaborative environments, Proceedings of the second ACM workshop on Role-based access control, RBAC '97, pp.13-19, 1997.

J. Wainer, P. Barthelmess, and A. Kumar, W-RBAC ??? A Workflow Security Model Incorporating Controlled Overriding of Constraints, International Journal of Cooperative Information Systems, vol.12, issue.04, pp.455-486, 2003.
DOI : 10.1142/S0218843003000814

X. Jin, Y. Chunyang, H. Yeping, H. Jianbo, and Z. Zhouyi, Applying Model Driven Architecture approach to Model Role Based Access Control System Mémoire de ma??trisema??trise A Verifiable Formal Specification for RBAC Model with Constraints of Separation of Duty, 2006.

Y. Eric and T. Jin, Attributed Based Access Control (ABAC) for Web Services

Z. John, W. Hoetech, C. Jonathan, and J. Daniel, RBAC Schema Verification Using Lightweight Formal Model and Constraint Analysis, Proceedings of the 8th ACM symposium on Access control models and technologies, SACMAT '03, 2003.

Z. Nan, R. Mark, P. Dimitar, and . Guelev, Synthesising verified access control systems in XACML, Proceedings of the 2004 ACM workshop on Formal methods in security engineering, pp.56-65, 2004.