Modeling security requirements through ownership, permission and delegation