A Posteriori Compliance Control

Etalle, Sandro and Winsborough, William H. (2007) A Posteriori Compliance Control. In: 12th ACM Symposium on Access Control Models and Technologies, SACMAT 2007, 20-22 June 2007, Nice, France.

Preview

PDF
252Kb

Abstract:	While preventative policy enforcement mechanisms can provide theoretical guarantees that policy is correctly enforced, they have limitations in practice. They are inflexible when unanticipated circumstances arise, and most are either inflexible with respect to the policies they can enforce or incapable of continuing to enforce policies on data objects as they move from one system to another. In this paper we propose an approach to enforcing policies not by preventing unauthorized use, but rather by deterring it. We believe this approach is complementary to preventative policy enforcement. We call our approach APPLE for A-Posteriori PoLicy Enforcement. We introduce APPLE Core, a logical framework for using logs to verify that actions taken by the system were authorized. A trust management system is used to ensure that data objects are provided only to users operating on auditable systems who are subject to penalty should they be found in violation. This combination of audit and accountability provides a deterence that strongly encourages trustworthy behavior, thereby allowing a high level of assurance of end-to-end policy enforcement.
Item Type:	Conference or Workshop Item
Copyright:	© 2007 ACM
Faculty:	Electrical Engineering, Mathematics and Computer Science (EEMCS)
Research Group:	Distributed and Embedded Systems (DIES)
Link to this item:	http://purl.utwente.nl/publications/67058
Official URL:	http://doi.acm.org/10.1145/1266840.1266843
Export this item as:	BibTeX EndNote HTML Citation Reference Manager

Show download statistics for this publication

Repository Staff Only: item control page

Metis ID: 241576