The ISC International Journal of Information Security

Abstract Ensuring secure and continuous access in smart environments requires dynamic and context-aware policy enforcement, which traditional access control models cannot adequately support. This paper presents SmartUcon, a model-driven domain-specific modeling language (DSML) based on the UCON+ model, designed for specifying and managing usage control policies in IoT-enabled and cyber-physical systems. SmartUcon provides a Sirius-based graphical editor for intuitive policy modeling, along with an EGL-based code generator that automatically transforms high-level models into executable Axiomatics Language for Authorization (ALFA) policies. The semantics of the DSML are defined translationally via explicit mapping rules to ALFA, ensuring semantic preservation. The framework further incorporates design-time conflict detection and model-time validation using the Epsilon Validation Language (EVL) to reduce policy misconfigurations. To evaluate its applicability, 14 case studies were developed across five domains—smart vehicles, smart homes, smart cities, healthcare, and industrial systems—while a user study with 32 participants and statistical significance tests confirm the usability advantages of graphical modeling. A structural comparison with related metamodels confirms its superior coverage of obligations, advice, and device interactions. Overall, SmartUcon offers a practical and extensible model-driven solution for secure and trustworthy policy enforcement in smart environments.

Abstract As cyber threats grow increasingly sophisticated, the importance of security training as an effective means of prevention will become even more critical. Cyber Range (CR) is a platform for creating cyber training programs using virtualization and simulation technologies to create a realistic training environment. The main challenge for utilizing a CR is the specialized human resources required to design and maintain training sessions. To tackle this challenge, several high-level languages, known as Scenario Description Languages (SDLs), have been developed to enable the specification of training environments as models. These models can then be automatically transformed into deployment artifacts. Our studies showed that the existing SDLs could not address requirements when designing complex scenarios where multiple trainees should collaborate to reach a desired goal through various acceptable solutions. We present the Collaborative Security Training SDL (CST-SDL) for creating multi-trainee and multi-solution scenarios. CST-SDL uses an acyclic directional graph for specifying the scenario's solution routes and allows defining trainees with unique tasks, goals, and solution routes during the training session. To evaluate the CST-SDL's capabilities, we have implemented and integrated it into the KYPO cyber range.

Abstract With the emerging concept of model transformation, information can be extracted from one or more source models to produce the target models. The conversion of these models can be done automatically with specific transformation languages. This conversion requires mapping between both models with the help of dynamic hash tables. Hash tables store reference links between the elements of the source and target model. Whenever there is a need to access the target element, we query the hash table. In contrast, this paper presents an approach by directly creating aspects in the source meta-model with traces. These traces hold references to target elements during the execution. Illustrating the idea of model driven engineering (MDE), This paper proposes a method that transforms UML class models to EMF ECORE model.