+ 
+
+ {{ props.authors }}, "{{
+ props.title
+ }}",
{{ props.reference
+ }}, doi: {{ props.doi }}.
+
+
+
+ {{ props.authors }}, "{{
+ props.title
+ }}",
{{ props.reference
+ }}, doi: {{ props.doi }}.
+
+
+
+# Expressing and Analyzing Information Security Requirements
+
+Our analysis utilizes [label propagation](/wiki/) to analyze the characteristics of data flows.
+First, we extract all possible flows from data flow diagrams or other model representations such as [Palladio software architecture](https://www.palladio-simulator.com/) models.
+Afterwards, we query these so-called [Transpose Flow Graphs (TFGs)](/wiki/) to identify violations of information security requirements that were denoted as [data flow constraints](/wiki/).
+Exemplary questions are:
+
+* Does personal data flow to unauthorized locations violating the GDPR?
+* Does data leave an internal server without being encrypted first?
+* Does the access to sensitive data follow Role-based Access Control (RBAC)?
+* Are there any data flows that merge two distinct types of data that would void anonymity?
+
+
+
+
+All aspects of the Karlsruhe Data Flow Diagram Analysis have been [scientifically published](/publications/) at multiple conferences and journals, e.g., the [data flow diagram notation](https://doi.org/10.5220/0010515300260037), or the [core analysis algorithms](https://doi.org/10.1016/j.jss.2021.111138). For a quick overview of the analysis framework, please see this key publication:
+
+