On the modeling and analysis of obligations

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2006, Pages 134-143

  Irwin, Keith ^a   Yu, Ting ^a   Winsborough, William H ^b  

^a NORTH CAROLINA STATE UNIVERSITY   (United States)

^b UNIVERSITY OF TEXAS AT SAN ANTONIO   (United States)

Author keywords

Obligations; Policy

Indexed keywords

DATA SECURITY POLICY; OBLIGATIONS; SECURE SYSTEM STATES;

COMPUTATIONAL COMPLEXITY; COMPUTER PRIVACY; INFORMATION MANAGEMENT; INFORMATION SERVICES; REQUIREMENTS ENGINEERING;

ACCESS CONTROL;

EID: 34547346853     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1180405.1180423     Document Type: Conference Paper

References (30)

1. R. J. Anderson. A security policy model for clinical information systems. In Proc. IEEE Symposium on Security and Privacy, pages 30-43, 1996.
2. E. Bertino, F. Buccafurri, E. Ferrari, and P. Rullo. A logical framework for reasoning on data access control policies. In Proc. 12th IEEE Computer Security Foundations Workshop, pages 175-189, 1999.
3. E. Bertino, S. Castano, and E. Ferrari. On specifying security policies for web documents with an XML-based language. In Proc. 6th ACM Symposium on Access Control Models and Technologies, Chantilly, VA, May 2001.
4. C. Bettini, S. Jajodia, X. S. Wang, and D. Wijesekera. Provisions and obligations in policy management and security applications. In VLDB, Hong Kong, China, Aug. 2002.
5. C. Bettini, S. Jajodia, X. S. Wang, and D. Wijesekera. Obligation monitoring in policy management. In IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY 2003), Lake Como, Italy, June 2003.
6. C. Bettini, S. Jajodia, X. S. Wang, and D. Wijesekera. Provisions and obligations in policy rule management. J. Network Syst. Manage., 11(3), 2003.
7. M. Blaze, J. Feigenbaum, and M. Strauss. Compliance Checking in the PolicyMaker Trust Management System. In Financial Cryptography, British West Indies, Feb. 1998.
8. C. Bussler and S. Jablonski. Policy resolution for workflow management systems. In Proc. Hawaii International Conference on System Science, Maui, Hawaii, January 1995.
9. D. Damianou, N. Dulay, E. Lupu, and M. Sloman. The Ponder Policy Specification Language. In 2nd International Workshop on Policies for Distributed Systems and Networks, Bristol, UK, Jan. 2001.
10. N. Damianou, N. Dulay, E. Lupu, and M. Sloman. The ponder policy specification language. In Proc. International Workshop on Policies for Distributed Systems and Networks, pages 18-38, 2001.
11. B. S. Firozabadi, M. Sergot, A. Squicciarini, and E. Bertino. A framework for contractual resource sharing in coalitions. In 5th IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY 2004, Yorktown Heights, New York, June 2004.
12. P. Gama and P. Ferreira. Obligation policies: An enforcement platform. In 6th IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY 2005), Stockholm, Sweden, June 2005.
13. P. Griffiths and B. Wade. An authorization mechanism for a relational database systems. ACM Transactions on Database Systems, 1(3), 1976.
14. M. A. Harrison, W. L. Ruzzo, and J. D. Ullman. Protection in operating systems. Communications of the ACM, 19(8):461-471, Aug. 1976.
15. IBM. Enterprise Privacy Authorization Language (EPAL 1.1) Specific ation. http://www.zurich.ibm.com/security/enterprise-privacy/epal/.
16. K. Irwin, T. Yu, and W. Winsborough. On the modeling and analysis of obligations. Technical Report NCSU CS TR 2006-26, North Carolina State University, 2006. ftp://ftp.ncsu.edu/pub/unity/lockers/ftp/csc_anon/tech/2006/ TR-2006-26.%,pdf.
17. S. Jajodia, P. Samarati, and V. S. Subrahmanian. A logical language for expressing authorizations. In Proc. 1997 IEEE Symposium on Security and Privacy, pages 31-42, 1997.
18. S. Jajodia, P. Samarati, V. S. Subrahmanian, and E. Bertino. A unified framework for enforcing multiple access control policies. In Proc. ACM SIGMOD International Conference on Management of Data, pages 474-485, 1997.
19. L. Kagal, T. W. Finin, and A. Joshi. A policy language for a pervasive computing environment. In IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY 2008), Lake Como, Italy, June 2003.
20. H. Kamoda, M. Yamaoka, S. Matsuda, K. Broda, and M. Sloman. Policy conflict analysis using free variable tableaux for access control in web services environments. In Policy Management for the Web Workshop, Chiba, Japan, May 2005.
21. M. Kudo and S. Hada. XML document security based on provisional authorization. In Proc. ACM Conference on Computer and Communication Security, Athens, Greece, November 2000.
22. N. Li, W. H. Winsborough, and J. C. Mitchell. Beyond proof-of-compliance: Safety and availability analysis in trust management. In Proceedings of IEEE Symposium on Security and Privacy, pages 123-139. IEEE Computer Society Press, May 2003.
23. T. Ryutov and C. Neuman. Representation and evaluation of security policies for distributed system services. In Proc. DARPA Information Survivability Conference and Exposition, January 2000.
24. M. Sailer and M. Morciniec. Monitoring and execution for contract compliance. Technical Report TR 2001-261, HP Labs, 2001.
25. R. Sandhu, V. Bhamidipati, and Q. Munawer. The ARBAC97 model for role-based aministration of roles. ACM Transactions on Information and Systems Security, 2(1):105-135, Feb. 1999.
26. R. S. Sandhu. The Schematic Protection Model: Its definition and analysis for acyclic attenuating systems. Journal of ACM, 35(2):404-432, 1988.
27. E. Sirer and K. Wang. An access control language for web services. In Proc. 7th ACM Symposium on Access Control Models and Technologies, Monterey, CA, June 2002.
28. X. TC. Oasis extensible access control markup language (xacml). http://www.oasis-open.org/committees/xacml/.
29. A. Uszok, J. M. Bradshaw, R. Jeffers, N. Suri, P. J. Hayes, M. R. Breedy, L. Bunch, M. Johnson, S. Kulkarni, and J. Lott. Kaos policy and domain services: Toward a description-logic approach to policy representation, deconfliction, and enforcement. In IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY 2008), Lake Como, Italy, June 2003.
30. OASIS eXtensible Access Control Markup Language (XACML). http://www.oasis-open.org/committees/xacml/, 2005.