Abstract
Society relies on the connections between information systems and, as need for these interconnected systems has grown, so has the system complexity. Modern system security can prove difficult; fully understanding the interactions of the system’s components is both technically intensive and time consuming. System security policy managers require a method by which they may clearly operate on system access security policies. This thesis describes a formal model for policy abstraction in a role-based access controlled environment, combination of multiple policies, and abstracted reconstruction of policy artifacts in this environment. This work contributes: formal role-based access control policy modeling, formal policy composition, and policy file reconstruction. This thesis demonstrates the applicability of the Hierarchical Security Policy model to role-based access control systems, capability to compose security policies from disparate sources, and capability to maintain enough information to permit modification and redeployment of security policy artifacts.