Gestion des conflits dans les politiques de contrôle d'usage
Nada Essaouini · HAL (Le Centre pour la Communication Scientifique Directe) · 2015
The security policies are commonly specified through permissions, prohibitions and obligations. Permissions and prohibitions are generally used to specify access control policies, while obligations are useful to express usage control policies. Two different types of obligations are generally considered, namely system obligations and user obligations. User obligations are associated with deadlines. When these obligations are activated, these deadlines provide the user with some time to enforce the obligation before violation occurs. Using obligations with deadlines in security policies may cause a new type of conflict. This kind of conflict could happen in presence of overlapping deadlines. In this thesis, we propose a language based on a deontic logic of actions to express permissions and obligations. The semantic of the proposed language is defined using the situation calculus formalism. This allows us to analyze decidability and complexity of several problems such as planning tasks. We then use the planning task to prove the existence of conflictual situations. Once the conflicts are detected, we use delegation to redistribute obligations in order to resolve these conflicts and thus avoid possible violations. Furthermore, we show that obligations and permissions are not sufficient to preserve interests of the system's users. Indeed, for fairness reasons, the possibility of executing actions achieving their interests should be always preserved. Otherwise, violations are triggered. However, these actions are not obligations since users have the choice to execute them or not. Thus, the violation is the consequence of system's failure in preserving the choice of users. Consequently, we enriched our model with right rules to enable this feature. Finally, we show how the use of rights allows the refinement of responsibility when conflicts occur.