Deriving implementation-level policies for usage control enforcement

Abstract

Usage control is concerned with how data is used after access to it has been granted. As such, it is particularly relevant to end users who own the data. System implementations of access and usage control enforcement mechanisms, however, do not always adequately reflect end user requirements. This is due to several reasons, one of which is the problem of mapping concepts in the end user's domain to technical events and artifacts. For instance, semantics of basic operators such as "copy" or "delete", which are fundamental for specifying privacy policies, tend to vary according to context. For this reason they can be mapped to different sets of system events. The behaviour users expect from the system, therefore, may differ from the actual behaviour. In this paper we present a translation of specification-level usage control policies into implementation-level policies which takes into account the precise semantics of domain-specific abstractions. A tool for automating the translation has also been implemented.

Data Usage Control for Distributed Systems

“…Since previous work showed how high-level OSL policies can be translated into technical Event-Condition-Action (ECA) rules ECA rule for enforcement purposes [108,109], this thesis focuses on such ECA rules. While the formal semantics of ECA rules are provided in [106,126], their intuitive semantics are as follows: Once a system event e ∈ S refining the trigger Event trigger event ∈ E (cf.…”

“…to indicate that a certain amount of time has passed. According to [108,109,156,172,174], ECA conditions (Φ) are specified in terms of past linear temporal logics [62,118,133]. Their syntax is specified as:…”

“…Most relevant for this thesis is the work by Kumari et al [106,108,109], which translate high-level specification policies into low-level implementation policies. The motivation is that regular end users aiming to protect their data are usually not capable of writing policies in low-level policy languages.…”

Automated Translation of End User Policies for Usage Control Enforcement

“…In contrast, the very idea of our work is a more generic approach that relies on instantiated domain meta models; this is the gap in usage control policy refinement that is filled by this work. A modelbased semi-automated approach to usage control policy derivation is described in [6,7]. We build on this work and achieve automated policy derivation.…”

“…Because data and actions on data are specific to an application domain, a three-layered domain meta-model for refining data and actions has been proposed in [6]. This meta-model ( Fig.…”