The increasing convergence of IT and OT in maritime infrastructure has amplified the cyber-physical threat landscape, exposing vessels to sophisticated, multi-stage attacks. Given the scarcity of specialized experts and the prohibitive cost of manual assessments, proactive automated penetration testing has become a critical necessity. However, Deep Reinforcement Learning (DRL) solutions struggle with the combinatorial explosion of state-action spaces and the inability of monolithic models to generalize across hybrid domains without catastrophic forgetting.

PRISM-AI1is a neuro-symbolic multi-agent framework designed to mitigate privacy risks during inference by Large Language Models (LLMs). The system integrates a symbolic rule engine based on first-order deontic logic (LogicMP) with a neural agent guided by prompt-engineered constraints aligned with GDPR and Act 25. Each agent fulfills a distinct role, including privacy rule enforcement, input analysis, explanation generation, and user interaction. PRISM-AI introduces a dual-stage privacy control mechanism that evaluates both user prompts and LLM outputs, enabling proactive and reactive filtering of sensitive content. Evaluation across a comprehensive benchmark spanning healthcare, finance, education, and general domains demonstrates that LogicMP achieves $82.5 \%$ accuracy compared to $\mathbf{7 1. 0 \%}$ for LLM-based detection, with $\mathbf{2, 8 0 6} \times$ faster processing and $100 \times$ lower memory usage, while achieving 29.3% precision advantage with perfect precision across Healthcare, Finance, and Education domains. The dual-stage architecture provides $10 \%$ proactive privacy violation prevention, with $100 \%$ of violations caught at the input stage. Legal justification coverage reaches $20 \%$ of blocked cases with automatic GDPR and Act 25 citations. The results underscore the benefits of combining symbolic and neural reasoning within a flexible agentic AI architecture for practical privacy protection.1Interactive demo and source code: https://github.com/SabrineAmri/ prism-ai-demo.git

Insider threats, where legitimate users misuse their access for malicious purposes, remain challenging to detect due to their contextual and behavioral subtleties. This paper presents a novel machine learning framework that captures user activity sequences through a user-centric representation named the User Daily Activity Sentence (UDAS). Unlike prior work that informally uses daily sequences, we formalize UDAS as a behavioral encoding technique using Word2Vec embeddings and extensively evaluate it across multiple unsupervised anomaly detection methods.To enrich this representation with relational context, we propose a graph-based extension that constructs a user interaction graph based on co-device usage and domain access. A Graph Convolutional Network (GCN) is applied to enhance semantic user embeddings, and anomaly detection is performed using Kmeans clustering.To the best of our knowledge, this is the first work to systematically combine semantic sequence embeddings with graph-based relational learning for insider threat detection. Experiments on the CERT Insider Threat v4.2 dataset show that our method outperforms prior unsupervised models in accuracy and robustness. The proposed framework requires no feature engineering or labeled data, making it applicable to real-world monitoring environments.

Role Mining (RM) extracts Role-Based Access Control (RBAC) structures from user-permission assignments to reduce administrative overhead. However, existing approaches usually make the assumption of clean datasets, while real-world systems suffer from anomalies like privilege creep, the gradual accumulation of unnecessary permissions.The proposed approach aims to detect potential privilege crept users who should be reviewed first, and identify legitimate permissions assignments to be expressed in RBAC, reducing management complexity. It consists of a two-step procedure: clean the User-Permission Assignment matrix (UPA) using a clustering and statistical analysis, then build an RBAC state using a regular role mining algorithm.The proposed approach yields an average of 90% in privilege creep detection accuracy and over 95% privilege creep correction, evaluated on synthetically made datasets. Evaluation on real-world datasets demonstrates an average 4-fold reduction in required roles while maintaining at least 80% UPA coverage.

Cyber insider threats represent one of the most complex and insidious challenges to modern cybersecurity, as they originate from legitimate users whose behaviors may turn malicious over time. Traditional approaches often fail due to their reliance on static risk indicators, necessitating dynamic modeling of human behavior to capture evolving risks. In this paper, we propose a novel framework for detecting insider threats by continuously and dynamically inferring personality-based risk indicators from employees’ writing data using a publicly accessible large language model (Meta AI’s Llama-3.2). These indicators are modeled as time series and processed through AutoRegressive Integrated Moving Average (ARIMA) models to forecast behavioral deviations. Predicted anomalies are subsequently classified using a hybrid ensemble combining Artificial Neural Networks (ANN) and Random Forest (RF) to distinguish benign variations from genuine insider threats. Our framework identifies behavioral anomalies, provides interpretable detection windows, and achieves the following results on CMU-CERT datasets (r4.2/r5.2): recall (90.0%/86.0%), precision (92.6%/87.7%), ROC-AUC (94.7%/92.6%), MSE (0.231/0.304), MTTD (21.3 days/31.72 days) and a median latency under 230 ms for real-time operation. These results demonstrate significant improvements over baseline static approaches in both detection accuracy and temporal prediction capability. This work advances human-centric and proactive insider threat detection by integrating personality-based risk indicators with predictive modeling, providing a scalable and interpretable solution for real-time dynamic risk assessment in enterprise environments.

With the increase in cyberattacks, developing appropriate strategies to mitigate and prevent them is essential. In the literature, tools exist that either help prevent or mitigate them. Attack graphs help define mitigation strategies because they help represent and visualize the attacker’s position on a system. However, the mitigation actions are not instantiated on the attack graph. This paper proposes an approach to generate an automated attack-defense graph based on real-time monitored system alerts and an extensive and comprehensive state-of-the-art review. We propose to enrich logical attack graphs generated by a logical reasoner. The enrichment process is possible thanks to a vulnerability ontology that infers additional impacts for an exploited vulnerability. We propose a countermeasure selection approach based on graph matching to generate an optimal Incident Response (IR) playbook. We propose instantiating the generated playbook’s IR actions to get an attack-defense graph in real-time. This instantiation is done thanks to anti-correlation. The anti-correlation ensures that the countermeasures are instantiated on the appropriate attack graph nodes. Only the IR actions whose execution can be launched automatically are applied. We validate our approach using two use-case scenarios that target critical industrial infrastructures. We analyze the countermeasures instantiated on the attack graphs for the scenarios that can achieve the attack goal. We evaluated the approach concerning the security relevance of instantiated countermeasures in attack graphs for several attack paths. The countermeasures instantiated on a node are always relevant to the attacker’s action represented by this node. We also evaluate the approach regarding time performance, considering several situations for the use-case scenarios. The generation time depends on the number of vulnerabilities involved in the scenario. The generation time is on average 0.161 s when the playbook has been generated before the attack defense graph generation process.

Insider threats in cybersecurity are notoriously difficult to detect due to their covert nature, often evading traditional security measures. In this paper, we propose an unsupervised method for insider threat detection, where we leverage advanced Natural Language Processing (NLP) techniques to enhance the detection of abnormal user activities indicative of insider threats. We represent user behaviors in a vector space using Word2Vec, which in turn are analyzed using state-of-the-art NLP models, including BERT, SciBERT, RoBERTa, GPT-2, and LLaMA. These models are integrated with Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) networks to analyze the temporal behavior of user actions. We evaluate the proposed method using the CMU-CERT dataset version 4.2. Our implemented approaches based on NLP achieve better results than previous state-of-the-art approaches that use traditional unsupervised learning.

Cyber-attacks are increasing; it is more urgent for organizations to automate their Incident Response (IR) plan process. Attack Graphs (AGs) are used to represent actions followed by an adversary to reach a goal. However, an expert should analyze each possible action and their impact to decide which mitigation actions should be applied to block the attack fulfillment. This paper proposes an approach to generate Attack-Defense Graphs in real-time by instantiating IR actions on a logical AG. The system’s real-time monitoring enables the detection of malicious actions, which leads to the generation of alerts mapped with the AG to deduce the attacker’s location on the system. Our solution can decide where to apply IR actions to mitigate the attack impact. These IR actions are part of playbooks that are generated automatically for the attack. We propose correlating IR actions with the AG fact nodes to choose which IR actions to instantiate on the AG. Therefore, we propose generating predicates for the mitigation actions, which are mapped with the AG predicates. We validate our approach with an industrial use case. An asset is vulnerable to Remote Code Execution (RCE) requiring user credentials that can be obtained through a brute force attack. We show how our approach helps anticipate an adversary’s next step. The countermeasures predicates are instantiated on the AG to prevent the attacker from going further on the system.

As computer networks face increasingly sophisticated attacks there is a need to create adaptive defensive systems that can select appropriate countermeasures to thwart attacks. The use of Deep Reinforcement Learning to train defensive agents is an avenue to study to meet this demand. In this paper we describe a simulated computer network environment wherein we conduct attacks and train defensive agents that employ Moving Target Defense and Deception strategies. We train an attacking agent, using Proximal Policy Optimization, to learn a policy to extract sensitive network data as quickly as possible from the environment. We then train a defending agent to prevent the attacker from reaching its objective. Our results demonstrate how the defender is able to learn a policy to inhibit the attacker.

Federated learning is a promising research direction in network intrusion detection. It enables collaborative training of machine learning models without revealing sensitive data. However, the lack of transparency in federated learning creates a security threat. Since the server cannot ensure the clients’ reliability by analyzing their data, malicious clients have the opportunity to insert a backdoor in the model and activate it to evade detection. To maximize their chances of success, adversaries must fine-tune the attack parameters. Here we evaluate the impact of four attack parameters on the effectiveness, stealthiness, consistency, and timing of data poisoning attacks. Our results show that each parameter is decisive for the success of poisoning attacks, provided they are carefully adjusted to avoid damaging the model’s accuracy or the data’s consistency. Our findings serve as guidelines for the security evaluation of federated learning systems and insights for defense strategies. Our experiments are carried out on the UNSW-NB15 dataset, and their implementation is available in a public code repository.

Physical access to a device can greatly help in vulnerability research as it opens up new vectors for exploitation. This is especially true for embedded devices, which often come with open serial ports and various types of debugging features. Therefore, security assessments of these devices should take into consideration the hardware components and their means of communication. In this paper, we explore a testing methodology that transforms a black box test into a white box test by using physical access to retrieve the code of the applications running on the device. To demonstrate its advantages, we apply this methodology to assess the security risks on a commercial router. We use it to uncover multiple code execution vulnerabilities in the router's firmware. We discuss secure coding guidelines to remediate those vulnerabilities and the importance of IoT security.

Deception and Moving Target Defense techniques are two types of approaches that aim to increase the cost of the attacks by providing false information or uncertainty to the attacker’s perception. Given the growing number of these strategies and the fact that they are not all effective against the same types of attacks, it is essential to know how to select the best one to use depending on the environment and the attacker. We therefore propose a model of attacker/defender confrontation in a computer system that takes into account the asymmetry of the players’ perceptions. To simulate attacks on our model, a basic attacker scenario based on the main phases of the Cyber Kill Chain is proposed. Analytically determining an optimal solution is difficult due to the model’s complexity. Moreover, because of the large number of possible states in the model, Deep Q-Learning algorithm is used to train a defensive agent to choose the best defensive strategy according to the observed attacker’s actions.

An Intrusion Detection System (IDS) aims to detect attacks conducted over computer networks by analyzing traffic data. Deep Reinforcement Learning (Deep-RL) is a promising lead in IDS research, due to its lightness and adaptability. However, the neural networks on which Deep-RL is based can be vulnerable to adversarial attacks. By applying a well-computed modification to malicious traffic, adversarial examples can evade detection. In this paper, we test the performance of a state-of-the-art Deep-RL IDS agent against the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM) adversarial attacks. We demonstrate that the performance of the Deep-RL detection agent is compromised in the face of adversarial examples and highlight the need for future Deep-RL IDS work to consider mechanisms for coping with adversarial examples.

Context: Internet-of-Things (IoT) systems are increasingly deployed in the real world, but their security lags behind the state of the art of non-IoT systems. Moving target defense (MTD) is a cyberdefense paradigm, successfully implemented in conventional systems, that could improve IoT security. Objective: Identify and synthesize existing MTD techniques for IoT and validate the feasibility of MTD as a cybersecurity paradigm suitable for IoT systems. Method: We use a systematic literature review method to search and analyze existing MTD for IoT techniques up to July 2020. We evaluated the existing techniques in terms of security foundations and real-world deployability using the evidence they provide. We define and use entropy-related metrics to categorize them. This is the first MTD survey to use Shannon's entropy metric empirically. Results: Thirty-two distinct MTD for IoT techniques exist: 54% are Network-layer-based, 50% present strong evidence about their real-world deployment, and 64% have weak security foundations. Conclusion: MTD for IoT is a feasible cyberdefense approach. A variety of proposals exist, with evidence about their implementation and evaluation. Nevertheless, the MTD for IoT state of the art is still immature: the security foundations of most existing proposals are weak. Novel techniques should prioritize providing convincing security foundations and real-world deployment evidence.

The Internet of Things (IoT) is more and more present in fundamental aspects of our societies and personal life. Billions of objects now have access to the Internet. This networking capability allows for new beneficial services and applications. However, it is also the entry-point for a wide variety of cyber-attacks that target these devices. The security measures present in real IoT systems lag behind those of the standard Internet. Security is sometimes completely absent. Moving Target Defense (MTD) is a 10-year-old cyber-defense paradigm. It proposes to randomize components of a system. Reasonably, an attacker will have a higher cost attacking an MTD-version of a system compared with a static-version of it. Even if MTD has been successfully applied to standard systems, its deployment for IoT is still lacking. In this paper, we propose a generic MTD framework suitable for IoT systems: IANVS (pronounced Janus). Our framework has a modular design. Its components can be adapted according to the specific constraints and requirements of a particular IoT system. We use it to instantiate two concrete MTD strategies. One that targets the UDP port numbers (port-hopping), and another a CoAP resource URI. We implement our proposal on real hardware using Pycom LoPy4 nodes. We expose the nodes to a remote Denial-of-Service attack and evaluate the effectiveness of the IANVS-based port-hopping MTD proposal.

We focus on resilience towards covert attacks on Cyber-Physical Systems (CPS). We define the new k-steerability and l-monitorability control-theoretic concepts. k-steerability reflects the ability to act on every individual plant state variable with at least k different groups of functionally diverse input signals. l-monitorability indicates the ability to monitor every individual plant state variable with £ different groups of functionally diverse output signals. A CPS with k-steerability and l-monitorability is said to be (k, l)-resilient. k and l, when both greater than one, provide the capability to mitigate the impact of covert attacks when some signals, but not all, are compromised. We analyze the influence of k and l on the resilience of a system and the ability to recover its state when attacks are perpetrated. We argue that the values of k and l can be augmented by combining redundancy and diversity in hardware and software techniques that apply the moving target paradigm.

The more services and functionalities are expected from contemporary systems, the more difficult it is to protect every part of them, to secure every access point or to watch on every connection and message. It is currently considered that security is less and less likely to be flawless and that some part or sub-system can fail or be under attack. In this case, what matters is the impact, not only on the affected part but on the whole system, of the failure or the attack. Resilience is the key property that describes systems' ability to handle these situations but only few metrics exist to evaluate systems' resilience. Some among them aim at predicting systems' resilience by considering systems' configurations and compositions, without considering a specific threat. However this kind of approach can be biased for some systems' configurations because of inaccuracies in the resilience evaluation model. One of these inaccuracies, called the double counting problem, is described in this article and a solution is given to limit its impact on the evaluation of resilience.

The a posteriori access control mode consists in monitoring actions performed by users, to detect possible violations of the security policy and to apply sanctions or reparations. In general, logs are among the first data sources that information security specialists consult for forensics when they suspect that something went wrong. One difficult challenge we face when analyzing logs, is the multiple log file formats. However, normalizing logs in one format needs a lot of processing especially because log files usually contain a high volume of data. Our study proposes then to tackle this problem, by leaving the different log formats as they are, and retrieving information from logs by querying them. A semantic mediator makes it possible to inter-operate various sources of information without modifying their internal functioning. It can be responsible for locating data sources, to transmit queries to each source, or from one source to another, to retrieve the queries responses and possibly send them back to other sources. To the best of our knowledge, semantic mediation techniques have been used to share information from heterogeneous data sources, but they were never used in the context of log analysis.

We propose a general solution to the problem of efficient substring search over encrypted data. The solution enhances existing “keyword” searchable encryption schemes by allowing searching for any part of encrypted keywords without requiring one to store all possible combinations of substrings from a given dictionary. The proposed technique is based on the idea of letter orthogonalization that allows testing of string membership by performing efficient inner products. We first propose SED-1, the base protocol for substring search. We then identify some attacks on SED-1 that demonstrate the complexity of the substring search problem under different threat scenarios. This leads us to propose our second and main protocol SED-2. The protocol is also efficient in that the search complexity is linear in the size of the keyword dictionary. We run several experiments on a sizeable real world dataset to evaluate the performance of our protocol.

In multi-cloud paradigm, cloud providers collaborate to form ad-hoc and ephemeral groups to fulfill the request of a single customer. In such settings, malevolent cloud providers may be tempted to provide cloud services that are below the expected quality. This temptation is further exacerbated by the inability of customers to effectively identify the responsible of service outage or degradation. Furthermore, the highly competitive nature of cloud marketplaces leads each provider to propose regularly innovative new services, making the system open and highly dynamic. The introduction of new cloud services into the system challenges the established trust order as customers and providers must accept the risk of taking decisions under uncertainty. This problem, known as the cold-start problem, have been studied in the literature from the perspective of the individuals (providers/customers) but to the best of our knowledge, no prior work tried to address it from the perspective of the exchanged services and resources. To that aim, we propose in this paper a similarity-based trust model that tackles both multi-cloud (i.e., group-repution) and services high turnover (i.e., cold-start). In our model, past similar experiences are transferred to the providers proposing new services to enable and boost decision making and collaboration. We propose also a schema to derive multi-cloud trust using both customers and providers feedback experiences. We present also evaluations results to show the benefit of using our proposal and their impact on the simulated cloud-marketplace.

Most Android users are required to communicate sensitive data (passwords, usernames, security codes, and credit card numbers) with applications. Hacker can launch phishing attacks to compromise user data confidentiality. He/She stealthily injects into the foreground a hijacking Activity at the right timing to acquire private information. In this paper, we propose an effective approach that uses the similarity between launched Activities in order to detect and reacts to hijacking attacks during runtime time. We demonstrate the effectiveness of our solution by quantifying the number of false positives that can be generated by our system. We observe that, in the worst case, our solution generates 4.2% of false positives and incurs only 0.39% performance overhead on a CPU-bound micro-benchmark.

The use of wireless communication is a major trend in the so called Supervisory Control and Data Acquisition systems (SCADA). Consequently, Wireless Industrial Sensor Networks (WISN) were developed to meet real time and security requirements needed by SCADA systems. In term of security, WISN suffer from the same threats that those targeting classical WSN. Indeed, attackers mainly use wireless communication as a medium to launch these attacks. But as these networks are used to manage critical systems, consequences of such attacks can be more harmful. Therefore, additionally to the use of cryptographic and authentication mechanisms, Intrusion Detection Systems (IDS) are also used as a second line of defense. In this paper we propose an efficient IDS deployment scheme specially tailored to fit WISN characteristics. It builds a virtual wireless backbone that adds security purposes to the WISN. We also show that the proposed deployment scheme provides a good traffic monitoring capability with an acceptable number of monitoring nodes. It particularly allows detecting that a packet has been forged, deleted, modified or delayed during its transmission.

International audience

In this paper, we give means to analyze obligation with deadline policies in order to predict all undesired situations. The previous studies were focused on obligation with deadline when deadlines are defined using temporal constraints, and the most of them were interested in how obligations impact and depend on authorization state. We particularly investigate obligations with deadlines when the deadlines are triggered by the execution of actions. A novel notion of overlapping obligations is introduced. Two obligations are overlapping when each one of them depends on an action which triggers the deadline of the other one. Thus, the paper starts by giving a formal definition of dependency between actions and then defines formally the overlapping obligations. The undesired situations are those that leads inevitably to violations. They are defined using the overlapping obligations and characterized using executable situations. The paper presents an algorithm to predict these situations based on a planning tool. We also provide an implementation of this algorithm and show how the dependency between actions and the number of actions impact the execution time needed to fully analyze obligation with deadline policies.

Formerly protected by isolation, the operational technology (OT) networks have become connected to the information technology (IT) networks. This integration have exposed OT networks to a myriad of known and new threats. Due to the criticality of many of the industrial platforms monitored by OT networks, providing guidelines for security good practices, alongside with tools for security enforcement have become a strategic priority. In particular, several security editors are proposing dedicated firewalls for OT networks. To date, the trend has been towards extending IT firewalls to detect and filter industrial communication protocols. In this paper, we show through experimental study that security solutions borrowed from IT only partially fit OT requirements. Indeed, the OT networks have very different properties. We propose a new approach that pushes the stateful filtering to the operational level for a fine and tailored access control for SCADA networks. We show how to model operational-process-aware rules using the context paradigm in the OrBAC model. Besides, we discuss practical issues regarding the enforcement of such rules in the next generation of industrial firewalls.

Constraints in access control models are used to organize access privileges in order to avoid fraudulent situations. Ensuring that the constraints are satisfied during the evolution of the system is an important issue. Thus, there is a need to have a formal reasoning language in order to express the constraints policy and to prove that the constraints are always satisfied. In this work, we propose a formal language based on the deontic logic of actions and situation calculus. The proposed language is easy to use to specify various constraints mentioned in the literature. In addition, we formally specify the condition to prove that the system specification is secure with respect to the access control requirements.

Recent advances in encrypted outsourced databases support the direct processing of queries on encrypted data. Depend- ing on functionality (i.e. operators) required in the queries the database has to use different encryption schemes with different security properties. Next to these functional re-quirements a security administrator may have to address security policies that may equally determine the used en-cryption schemes. We present an algorithm and tool set that determines an optimal balance between security and functionality as well as helps to identify and resolve possible conflicts. We test our solution on a database benchmark and business-driven security policies.

The secure interaction between different applications and services requires negotiation of their security properties. This is typically defined as a security policy contract, which aims at coordinating diverse security policies of different actors. Although considerable attention has been attracted to this theme in the recent literature of e-contract and negotiation, there is not a complete framework to negotiate security policies. In this paper, we propose a framework and an algorithm to negotiate security policy. The paper shows mainly how an agreement could be reached between two negotiators with our negotiation model. Besides, it advances an approach to evaluate the relationship between security policies.

We argue in this paper that while trust management through negotiation performed in IT system might seem appropriate at first sight, it has to be extended to address specific concerns to interoperable environments like the case in Intelligent Transportation Systems - ITS environment. In this context, negotiation does not only depend on trust requirements, but is strongly linked to the security policies as well as to the privacy related attributes shared among entities during communication. This paper discusses what needs to be negotiated in ITS environment and how we can model these negotiation rules in security policies. Besides, it proposes an approach to use the XeNA negotiation framework [1] to negotiate these different types of resources.

Many papers have already provided models to formally specify security policies. In this paper, security policies are modeled using deontic concepts of permission and obligation. Permission rules are used to specify access control policies, while obligation rules are useful to specify other security requirements corresponding to usage control policies as the availability of information in its allotted time. However, when both permission and obligation concepts are used to express security policies, several different types of conflict can be raised and should be detected and managed. We are interested in this work in managing conflicts between obligations with deadlines and permissions. Thus, we first begin by formally defining the conflicting situations using the situation calculus. Afterwards, we provide an algorithm for searching a plan of actions, when it exists, which fulfills all the active obligations in a given situation in their deadlines with respect to the permission rules. The length of the plan is set in advance and can be calculated in the case where the sets of actions and fluents are finite to ensure the decidability of the solution search. Furthermore, in the plan search, the choice of the execution time of the elected actions obeys to equations and inequalities which need to be solved. For this purpose, we need a component allowing these equations and inequalities resolution. To illustrate our approach, we take an example inspired from existing laws in hospitals regulating deadlines for completion of patient medical records. The example is formally specified in our language and implemented in ECRC Common Logic Programming System ECLIPSE 3.5.2, which is equipped with Simplex algorithm for solving linear equations and inequalities over the reals. In the implementation, we show how the plan search can be optimized through the use of some heuristics and make some evaluation tests.

In this paper, we adapt the robust reversible watermarking modulation originally proposed by Vleeschouwer for images to the protection of relational databases. The resulting scheme modulates the relative angular position of the circular histogram center of mass of one numerical attribute for message embedding. It can be used for verifying database authentication as well as for traceability when identifying database origin after it has been modified. Beyond the application framework, we theoretically evaluate the performance of our scheme in terms of capacity, distortion, and robustness against two common database modifications: 1) addition and 2) removal of tuples. To that end, we model the impact of the embedding process and of database modifications on the probability distribution of the center of mass position. We further verify experimentally these theoretical limits within the framework of a medical database of more than one million of inpatient hospital stay records. We show that under the assumptions imposed by the central limit theorem, experimental results fit the theory. We also compare our approach with two recent and efficient schemes so as to prove its benefits.

A security policy defines the rules to ensure the security properties of an information system. These rules are often expressed as permissions, prohibitions and obligations which could lead to conflicting situations. We are interested in this work in managing conflict between obligations with deadlines. We define a process based on the situation calculus to provide a plan of actions, when it exists, which fulfills all obligations in their deadlines. To illustrate our approach, we take an example of obligation rules with deadline concerning completion of patient medical records.

Collection and distribution of Radio Frequency IDentification (RFID) data are subject to various privacy concerns. These concerns are of paramount importance when sensitive data are processed (e.g., medical data). Therefore, it is crucial to treat sensitive data privacy in early stages to master the data view for upper layers and to minimize, as soon as possible, the risk of unauthorized disclosures. While most recent works focus on securing the access and visibility of collected information in the final databases, data processed in the middleware do not seem involved in the process of privacy protection. Current EPCglobal standards for RFID also suffer from insufficient attention to this issue. In this paper, we propose a privacy controller module that enhances the Filtering and Collection (F&C) middleware of the EPCglobal network. We provide a privacy policy-driven model, using some enhanced contextual concepts of the extended Role Based Access Control model. The feasibility of our privacy-enhanced model is shown by integrating our solution into the F&C middleware of the Fosstrak framework, an open-source implementation of the EPCglobal network specifications.

Shamir proposed the setbase approach as a means of improving security and privacy of the traditional biometric system. In this paper, we propose privacy-preserving drawer size standards for the biometric setbase. The proposal incorporates database privacy metrics such as k-anonymity and l-diversity into the definition of privacy-preserving drawer size standard for the biometric setbase. We also empirically evaluate the system reliability of the prototype setbase for the purpose of studying the trade-off values between the level of privacy protection and the level of system security.

In this demo paper, we present a new privacy preserving composition execution system. Our system allows to execute queries over multiple data services without revealing any extra information to any of the involved services. None of involved services (and their providers) is able to infer any information about the data the other services provide beyond what is permitted

The Electronic Product Code (EPC) is a Radio Frequency IDentification (RFID) that offers a new way of automating identification. However, once RFID tags carry more than just an identifier, privacy may be violated. Treating the privacy in early stages helps to master the data view before interpreting and storing it in databases. An RFID middleware is the entity that sits between tag readers and database applications. It is in charge of collecting, filtering, aggregating and grouping the requested events from heterogeneous RFID environments. Thus, the system, at this point, is likely to suffer from parameter manipulation and eavesdropping, raising privacy concerns. We propose a privacy controller module that enhances the Filtering and Collection middleware of the RFID EPCglobal network. We provide a privacy policy-driven model using some enhanced contextual concepts of the extended Role Based Access Control model. To show the feasibility of our privacy-enhanced model, we provide a proof-of-concept prototype integrated into the middleware of the Fosstrak framework, an open-source implementation of the EPCglobal specifications.

Shamir proposed the setbase approach as a means of improving security and privacy of the traditional biometric system. As a result of the limitation of the current setbase filling procedure, we demonstrate that there are potential privacy weaknesses due to non-default distributions on attributes inside the identity database. We introduce in this paper, the concept of ϵ-closeness as a general framework to describe quantitatively the distribution anomaly. As a consequence, we are able to formulate a privacy-preserving drawer size standard for the setbase that includes the non-default distribution cases.

Obligations are an essential element of security policies since they enable the specification of many security requirements such as availability, privacy, usage control and data protection. In everyday life, the fulfillment of obligations is often the responsibility of more than one subject, e.g., “All patients must be checked by one of the doctors”. Obligations may also be fulfilled in different ways, e.g., “Every customer should pay either in cash or by check”. Current security policy languages do not enable the specification of these intuitive and much needed requirements. In this paper, we show how policy languages can be extended to support the specification of these requirements which we call group obligations. To clarify the semantics of group obligations, we introduce state-based models for both group and individual obligations and show how group obligations can be managed according to change in the state of individual obligations. We formalize the semantics of the model and interactions between individual and group obligations by introducing a policy-enforcement language ℒ E . ℒ E enables the formal description of the application domain and the policy and provides operational semantics for policy management. Moreover, we discuss termination and determinism of policy enforcement in the proposed framework and show how different sanction/reaction policies may be activated when group obligations are violated.

In this paper, we propose a new reversible watermarking scheme. One first contribution is a histogram shifting modulation which adaptively takes care of the local specificities of the image content. By applying it to the image prediction-errors and by considering their immediate neighborhood, the scheme we propose inserts data in textured areas where other methods fail to do so. Furthermore, our scheme makes use of a classification process for identifying parts of the image that can be watermarked with the most suited reversible modulation. This classification is based on a reference image derived from the image itself, a prediction of it, which has the property of being invariant to the watermark insertion. In that way, the watermark embedder and extractor remain synchronized for message extraction and image reconstruction. The experiments conducted so far, on some natural images and on medical images from different modalities, show that for capacities smaller than 0.4 bpp, our method can insert more data with lower distortion than any existing schemes. For the same capacity, we achieve a peak signal-to-noise ratio (PSNR) of about 1-2 dB greater than with the scheme of Hwang , the most efficient approach actually.

The use of role engineering has grown in importance with the expansion of highly abstracted access control frameworks in organizations. In particular, the use of role mining techniques for the discovery of roles from previously deployed authorizations has facilitated the configuration of such frameworks. However, the literature lacks from a clear basis for appraising and leveraging the learning outcomes of the role mining process. In this paper, we provide such a formal basis. We compare sets of roles by projecting roles from one set into the other set. This approach allows to measure how comparable the two configurations of roles are, and to interpret each role. We formally define the problem of comparing sets of roles, and prove that the problem is NP-complete. Then, we propose an algorithm to map the inherent relation among the sets based on algebraic expressions. We demonstrate the correctness and completeness of our solution, and investigate some further issues that may benefit from our approach, such as detection of unhandled perturbations or source misconfiguration.

When specifying privacy preferences, the data owner can control who may access its personal data, for which purpose and under which accuracy. In this paper we present an approach that enforces the privacy policy preferences by query transformation. We present also how to instrument this rewriting query algorithm using a privacy-aware model like PrivOrBAC. We take into account various dimensions of privacy preferences through the concepts of consent, accuracy, purpose and recipient.

This paper extends RBAC sessions with share ability, reusability and switch ability properties. We define the Smatch (Secure Management of switch) model in which authorized users can join, leave, reopen and reuse dynamic sessions. In Smatch, subjects can also share sessions and dynamically switch their role or function with other subjects from the same or die rent organizations. Subjects can authenticate using their function which will automatically activate the set of roles associated with this function. The Smatch model is based on first order logic with actions. It provides means to specify contextual access control and authentication policies which apply to control functional behavior of dynamic sessions. We suggest an implementation of Smatch using virtual machines.

Standard multilevel security (MLS) policies lack flexibility as data classification is considered static. Previous works have addressed this issue and defined declassification requirements, especially in programming languages using a language-based security approach. In this paper, we suggest a dif ferent approach. We show how to define and enforce declassification policies in databases, seen as sets of logical facts. We first define an information flow con trol model where data classification may dynamically change. This model combines both confidentiality and integrity requirements to enforce security. We then specify how to enforce declassification policies. Our approach relies on Event-Condition-Action (ECA) rules and provides means to manage the four basic di mensions of declassification, namely the what?, who?, where? and when? which respectively refer to model ing information to be declassified, entities responsible for declassification, localization of the declassification and contextual conditions that control declassifica tion. We formalize and specify our declassification policies and prove it safe and secure with respect to the information flow control model.

Pre-obligations denote actions which may be required before access is granted. The successful fulfillment of pre-obligations authorizes the requested access. Thus, preobligations induce interactions between the obligation and authorization policy states. This paper studies these interactionsby formalizing the evolution of the authorization and obligation states when pre-obligations are supported. The main advantage of the presented approach is that pre-obligations are given both declarative semantics based on predicate logic and operational semantics based on Event-Condition-Action (ECA) rules. Furthermore, the presented framework enables policy designers to easily choose to evaluate any pre-obligation either(1) statically (an access request is denied if the pre-obligation has not been fulfilled); (2) or dynamically (users are given the possibility to fulfill the pre-obligation after the access request and before access is authorized).

Deploying a security policy may prove difficult whenever the system does not embed all necessary security functionalities. Some specific functionalities are required to accurately evaluate the contexts viewed as constraints in which some security requirements are to be met. Dynamic or contextual requirements are problematic since they rely on specific functionalities which are not always available in the system or are even impossible to acquire given the current technologies. Therefore, it is essential to ensure that the contextual requirements are always managed and well deployed taking into account the existent functionalities in the system. We present a solution to cope with the following issue: ensuring that the contextual security requirements are always best deployed within the set of functionalities in the system.

Traditional access control mechanisms prevent illegal access by controlling access right before executing an action; they belong to a class of a priori security solutions and, from this point of view, they have some limitations, like inflexibility in unanticipated circumstances. By contrast, a posteriori mechanisms enforce policies not by preventing unauthorized access, but rather by deterring it. Such access control needs evidence to prove violations. Evidence is derived from one or several log records, which trace each user's actions. Efficiency of violation detection mostly depends on the compliance of log records with the access control policy. In order to develop an efficient method for finding these violations, we propose restructuring log records according to a security policy model. We illustrate our methodology by applying it to the healthcare domain, taking care of the IHE (Integrating the healthcare enterprise) framework, particularly its basic security profile, ATNA (Audit Trail and Node Authentication). This profile defines log records established on the analysis of common health practice scenarios. We analyze and establish how ATNA log records can be refined in order to be integrated into an a posteriori access and usage control process, based on an expressive and contextual security policy like the OrBAC policy.

Intrusion response models and systems have been recently an active field in the security research. These systems rely on a fine diagnosis to perform and optimize their response. In particular, previous papers focus on balancing the cost of the response with the impact of the attack. In this paper, we present a novel attack response system, based on the assessment of the likelihood of success of attack objectives. First, the ongoing potential attacks are identified, and their success likelihood are calculated dynamically. The success likelihood depends mainly on the progress of the attack and the state of the monitored system. Second, candidate countermeasures are identified, and their effectiveness in reducing the pre-calculated success likelihood are assessed. Finally, the candidate countermeasures are prioritized.

In this paper, we describe a security model where users are allowed to control their obligations partially or totally, depending on the security policy. The main motivation of our work is to design more flexible systems that take into account users' requirements in order to avoid obligation violations and therefore sanctions. In our model, users are able to negotiate or delegate their obligations in the case of incapacity to fulfill them. This is an important aspect to be considered, since it is common that, at work or in everyday life, a user may need to negotiate the fulfillment of a given obligation, or also need the help of others to perform a task on his/her behalf. This may be due to several reasons such as absence, vacation, conflict of interest, lack of time, of resource, of competence or simply for the sake of efficiency. In our model, we propose an approach to deal with the negotiation and the delegation of obligations based on the concept of contexts.

Many research works focused on modeling relational database management systems (DBMS) that support multilevel security (MLS) policies. However, most of these previous proposals only consider static aspects of relational databases and do not address dynamicity provided by mechanisms like triggers. Since such mechanisms introduced specific security problems, in particular they create new information flows, it is necessary to extend traditional MLS models designed for relational databases to handle these problems. However, it has been shown in many papers that triggers lack a formal model to support them and so they are not free of ambiguities. To address these theoretical limitations of trigger, our work is based on a formal model that applies MLS policies to active databases. Active databases provide a more expressive and formal framework than triggers. In this paper, we first define an information flow model for active databases. Based on this security model, we then present security requirements that are sufficient to prevent illegal information flows and prove them using the B method.

With the growth of modern systems and infrastructures, automated and intelligent response systems become the holy grail of the security community. An interesting approach proposes to use dynamic access control policies to specify response policies for such systems. These policies should been forced when an ongoing attack, that threatens the monitored system, is detected. However, existing work do not present a clear methodology to specify the Response policies. In particular, the deactivation issue is not yet tackled. In this paper, we first present how to specify response policies. Second, a risk-aware framework is proposed to activate and deactivate response policies. Hence, the success likelihood of the threat, and the cumulative impact of both of the threat and the response, are all considered.

Workflow management systems (WFMS) are concerned with the control and coordination of operational business processes, called workflows. When workflow technology is deployed in domains where processes have simple coordinative requirements, the flow of control and data may be easily mapped onto process effectiveness. With the diversity of resources, subjects and activities in the system, ensuring a secure execution environment of the workflow becomes a critical issue. In this paper, we are interested in deploying a WFMS security policy. We investigate this issue either within intra or inter organizational workflows. The later case is more complex and requires more sophisticated control since it includes communications between different organizations.

The successful deployment of a security policy is closely related not only to the complexity of the security requirements but also to the capabilities/functionalities of the security devices. The complexity of the security requirements is additionally increased when contextual constraints are taken into account. Such situations appear when addressing the dynamism of some security requirements or when searching a finer granularity for the security rules. The context denotes those specific conditions in which the security requirements are to be met. (Re)deploying a contextual security policy depends on the security device functionalities: either (1) the devices include all functionalities necessary to deal with a context and the policy is consequently deployed for ensuring its automatic changes or (2) the devices do not have the right functionalities to entirely interpret a contextual requirement. We present a solution to cope with this issue: the (re)deployment of access control policies in a system that lacks the necessary functionalities to deal with contexts.

IPv6 is an attractive technology for innovative services such as health care monitoring, alarm systems, peer to peer applications, virtual machine systems and so on. The generalization of end to end paradigm, possible due to the length of IPv6 addresses, eases the deployment of such services. Nevertheless end to end connection can be a threat since application can be easily accessible from outside and thus a compromised application may endanger others. In this paper, we study some of the advantages of using the IPv6 protocol in home networks but most particularly how to improve the security of home networks. We present an architecture allowing the definition of a partition between groups of applications and where communication between these groups is not permitted if there is no explicit delegation. We overview the key points of the current implementation and some initial results of our approach.

Intrusion detection requirements enforced by Intrusions Detection Systems (IDSs) are generally considered independently from the remainder of the security policy. Our approach is to consider that intrusion detection requirements are actually a part of the access control policy. This provides means to formally specify in a reaction policy what should happen in case of intrusion. It is then possible to integrate these requirements into a deploying process in order to automatically configure security components. In this paper, we propose a contextual and ontology-based approach to express and instantiate this reaction policy. We then define a reaction process based on the concepts of dynamic threat organisation and threat contexts and a set of rules used to map alerts onto threat contexts to perform the instantiation of the policy-based reaction in response to the detected intrusion.

During interoperability exchanges, organizations are jointly conducting computation and sharing tasks. However, organizations can have different security policies. To guarantee good interoperability exchanges, organizations need to share with other participants information about the services they provide. In addition, to be compliant with security requirements during interoperability, security policies have to be dynamic. One purpose of this paper is to provide this dynamic behavior by taking care about context of access parameters. The context-aware security requirements may be met by using a contextual access control model to define the security policy of each party involved in the interaction, and OrBAC (Organization based Access Control) is an adequate model for this purpose. Elaborating an ontology based security model provides a mean to ensure sharing of understandable knowledge, in particular knowledge needed to derive the authorized accesses and usages during the interoperability sessions. In this paper, we thus suggest a context ontology to be combined with an ontological representation of the OrBAC model and show how it can be used to ease the security rules definition and derivation during interoperability sessions.

Workflows are operational business processes. Workfow Management Systems (WFMS) are concerned with the control and coordination of these workflows. In recent years, there has been a trend to integrate WFMS in distributed inter-organizational systems. In this case malfunctioning of one WFMS can affect more than one organization, making the correct functioning of a WFMS a critical issue. Thus, an important function of WFMS is to enforce the security of these inter-organizational workflows. Several works have been done to integrate the security aspects in the workflow specification. Unfortunately, these research works generally adopt a centralized management approach and are based on static access control models. Therefore, they do not deal with flow control, a very important requirement in WFMS. In this paper, we suggest a decentralized and dynamic approach to handle a security policy in workflows taking into account access and flow control.

To address the evolution of security incidents in current communication networks it is important to react quickly and efficiently to an attack. The RED (Reaction after Detection) project is defining and designing solutions to enhance the detection/reaction process, improving the overall resilience of IP networks to attacks and help telecommunication and service providers to maintain sufficient quality of service and respect service level agreements. Within this project, a main component is in charge of instantiating new security policies that counteract the network attacks. This paper proposes an ontology-based approach to instantiate these security policies. This technology provides a way to map alerts into attack contexts, which are used to identify the policies to be applied in the network to solve the threat. For this, ontologies to describe alerts and policies are defined, using inference rules to perform such mappings.

Nowadays, intrusion detection systems do not only aim to detect attacks; but they go beyond by providing reaction mechanisms to cope with detected attacks, or at least reduce their effects. Previous research works have proposed several methods to automatically select possible countermeasures capable of ending the detected attack, but without taking into account their side effects. In fact, countermeasures can be as harmful as the detected attack. Moreover, sometimes selected countermeasures are not adapted to the attacker’s actions and/or knowledge. In this paper, we propose to turn the reaction selection process intelligent by giving means to (i) quantify the effectiveness and select the countermeasure that has the minimum negative side effect on the information system by adopting a risk assessment and analysis approach, and (ii) assess the skill and knowledge level of the attacker from a defensive point of view.

The existence of errors or inconsistencies in the configuration of security components, such as filtering routers and/or firewalls, may lead to weak access control policies - potentially easy to be evaded by unauthorized parties. We present in this paper a proposal to create, manage, and deploy consistent policies in those components in an efficient way. To do so, we combine two main approaches. The first approach is the use of an aggregation mechanism that yields consistent configurations or signals inconsistencies. Through this mechanism we can fold existing policies of a given system and create a consistent and global set of access control rules - easy to maintain and manage by using a single syntax. The second approach is the use of a refinement mechanism that guarantees the proper deployment of such a global set of rules into the system, yet free of inconsistencies

Trust establishment is necessary in every negotiation between entities from different security domains. It is seen as a first step before gaining access to protected resources. In this paper, we introduce a new classification methodology for protected resources. We use this classification to define the behavior of entities within a state based negotiation process. This process is enforced by two modules, the negotiation module and the exception treatment module. The first one intercepts all the requests for access. It collects credentials and exchanges policies according to the available negotiation policies. The second one is called by the first one whenever an exception is raised. An exception is a non negotiated denied access or locked negotiation.

Nowadays, security policies are the key point of every modern infrastructure. The specification and the testing of such policies are the fundamental steps in the development of a secure system since any error in a set of rules is likely to harm the global security. To address both challenges, we propose a framework to specify security policies and test their implementation on a system. Our framework makes it possible to generate in an automatic manner, test sequences, in order to validate the conformance of a security policy. system behavior is specified using a formal description technique based on extended finite state machine (EFSM) [12]. The integration of security rules within the system specification is performed by specific algorithms. Then, the automatic tests generation is performed using a dedicated tool, called SIRIUS, developed in our laboratory. Finally, we briefly present a weblog system as a case study to demonstrate the reliability of our framework.

Information systems are more and more victim of denial of service attacks. Thus, availability is a critical property which is more and more difficult to achieve. In this paper, we devise a new approach to design programs that enforce availability requirements. This approach is based on a formal security model called Nomad which combines deontic and temporal logics. We show how to use this model to specify availability requirements. Our proposal is then based on aspect programming. For this purpose, availability requirements expressed in the Nomad model are transformed into availability aspects. Using aspect programming languages such as AspectJ, we can then weave these availability aspects to transform an insecure program into a secure one.

Distributed denial of service attacks (DDoS) are becoming a big threat to the Internet. Recently, some DDoS attacks have infected more than 100,000 vulnerable hosts over Internet within 10 minutes. Consequences of these attacks can be devastating toward many companies whose security policy against this kind of attacks relies only on reconfiguring firewalls. It is judicious to note that no computer network is immune from intrusions in general and distributed denial of service attacks in particular. Intrusion detection systems should be geographically distributed to detect distributed and cooperated attacks. In this paper, we use a cooperative approach, which uses the Intrusion Detection Message Exchange Format (IDMEF) defined by the IETF, that can detect coordinated attack scenarios through alert correlation of distributed IDSs. We present our experience in realizing this cooperative system and the different results obtained from its implementation in a real network.

Modelling security policies requires means to specify permissions and prohibitions. However, this is generally not sufficient to express security properties such as availability and obligations must be also considered. By contrast to permissions and prohibitions, obligations are often associated with deadlines to specify bounded time availability requirements. In this case, a violation only occurs if the obliged action is not performed before the deadline. On the other hand, when specifying high level security policies, it is convenient to consider abstract non atomic actions. Since most access control mechanisms only deal with atomic actions such as read or write, these non atomic actions must be decomposed into more basic ones. In this paper, we define a formal security model called Nomad to express privileges on non atomic actions. This model combines deontic and temporal logics. In Nomad, we model conditional privileges and obligations with deadlines. We also formally analyze how privileges on non atomic actions can be decomposed into more basic privileges on elementary actions.

As computer infrastructures become more complex, security models must provide means to handle more flexible and dynamic requirements. In the organization based access control (Or-BAC) model, it is possible to express such requirements using the notion of context. In Or-BAC, each privilege (permission or obligation or prohibition) only applies in a given context. A context is viewed as an extra condition that must be satisfied to activate a given privilege. We present a taxonomy of different types of context and investigate the data the information system must manage in order to deal with these different contexts. We then explain how to model them in the Or-BAC model.

In the health care sector, access to medical information is more and more electronically achieved. Therefore, it is very important to define security policies which restrict access to pieces of information in order to guarantee security properties like confidentiality or integrity properties. These security policies are not always free of conflicts, in particular in the presence of exceptional situations.This paper proposes tools for access control, based on the notion of roles, in the possibilistic logic framework. We first show how to formalize basic concepts of security policies. Then we present two approaches for dealing with conflicts based on a stratification of security policy's rules. Finally, an example of health care is presented.

This paper presents the work we have done within the MIRADOR project to design CRIM, a cooperative module for intrusion detection systems (IDS). This module implements functions to manage, cluster, merge and correlate alerts. The clustering and merging functions recognize alerts that correspond to the same occurrence of an attack and create a new alert that merge data contained in these various alerts. Experiments show that these functions significantly reduce the number of alerts. However, we also observe that alerts we obtain are still too elementary to be managed by a security administrator. The purpose of the correlation function is thus to generate global and synthetic alerts. This paper focuses on the approach we suggest to design this function.

There are several approaches for intrusion detectionbut none of them is fully satisfactory. They generallygenerate too many false positives and the alerts are tooelementary and not enough accurate to be directlymanaged by a security administrator. A promisingapproach is to develop a cooperation module to analyzealerts and to generate more global and synthetic alerts.This paper presents the work we did in this context withinthe MIRADOR project. We suggest specifications for threefunctions: alert base management, alert clustering andalert merging. The approach is compliant with theIDMEF format currently being defined at the IETF.

The problem of combining pieces of information issued from several sources can be encountered in various fields of application. This paper aims at presenting the different aspects of information fusion in different domains, such as databases, regulations, preferences, sensor fusion, etc., at a quite general level. We first present different types of information encountered in fusion problems, and different aims of the fusion process. Then we focus on representation issues which are relevant when discussing fusion problems. An important issue is then addressed, the handling of conflicting information. We briefly review different domains where fusion is involved, and describe how the fusion problems are stated in each domain. Since the term fusion can have different, more or less broad, meanings, we specify later some terminology with respect to related problems, that might be included in a broad meaning of fusion. Finally we briefly discuss the difficult aspects of validation and evaluation. © 2001 John Wiley & Sons, Inc.

It often happens that organizations or companies have to respect several regulations simultaneously. Here, we analyze a practical example which applies to the context of documents containing sensitive information. This example considers the problem of downgrading the classification of these documents when their contents become obsolete. There are several regulations that deal with this problem and it appears that these regulations are conflicting. In this article, we suggest a general approach to detect and solve the conflicts between the regulations and show how it applies to our practical example. © 2001 John Wiley & Sons, Inc.

It often happens that organizations or companies have to respect several security policies simultaneously. The authors analyze a practical example which applies to the context of documents containing sensitive information. This example considers the problem of downgrading the classification of these documents when their contents become obsolete. There are several security policies that deal with this problem and it appears that these security policies are conflicting. They suggest a general approach to detect and solve the conflicts between the security policies and show how it applies to the practical example.

In this paper, we are interested in formally modeling the concept of responsibility.It appears that this concept is essential in order to reason in many norm-governed organizations.However, obtaining a formal representation of responsibility is quite complex because of the very different meanings this concept can take.Therefore, our first task will be to clarify and classify the various meanings.We then propose a logical framework and show how it enables us to model several aspects of responsibility, This framework combines a deontic logic with a logic of actions and it distinguishes between direct and indirect agencies.We finally present an example to illustrate how this framework enables us to analyze some subtleties of a specific situation.

We discuss the development of a methodology for reasoning about properties of security policies. We view a security policy as a special case of regulation which specifies what actions some agents are permitted, obliged or forbidden to perform and we formalize a policy by a set of deontic formulae. We first address the problem of checking policy consistency and describe a method for solving it. The second point we are interested in is how to query a policy to know the actual norms which apply to a given situation. In order to provide the user with consistent answers, the normative conflicts which may appear in the policy must be solved. For doing so, we suggest using the notion of roles and define priorities between roles.

The objective of this paper is to assist the security administrators, in their attempt to specify, define and formalize security policies suited to a given high risk environment. It is then possible for the administrators to automatically derive consequences of these policies. In particular we want to provide users with the following functionalities: query a given security policy; verify that properties such as consistency and completeness are enforced by a given policy; verify that a given situation does not violate the security policy; investigate interoperability problems between several security policies. In this paper we more precisely focus on the problem of security policies formulization. We want to get a generic approach, being as much domain-independent as possible. In order to achieve the above goals, we have chosen a logic-based approach. It combines a deontic logic to model the concept of permission, obligation and prohibition with a modal logic of action. It also includes the possibility to deal with additional concepts such as role, responsibility and delegation. We illustrate this approach through a case study: a regulation whose purpose is to define means to protect secret data related to the National Defense.

This paper addresses the problem of conflicting norms.The solution we describe is based on the concept of role: a role defines some permissions, obligations and prohibitions which are supposed free of conflicts.As soon as an individual plays a role, he inherits the set of norms associated with this role.We show that conflicting norms arise because an individual may play different roles.The central idea of our paper is to consider that it is possible to make a judgement of priority between the roles an individual plays, in order to decide which are the actual norms which apply in a given situation.This priority may be chosen by the individual or may be dependent on the structure which may exist between roles.Our paper mainly describes the axiomatic part of a logic for reasoning about norms associated with primitive roles as well as with composite roles obtained by merging several roles.

We propose a general model of representation of systems which takes into account asynchronous systems. We show that, as non deducibility on strategies, the causality property is also a hook-up property and we generalize this result to the case of asynchronous machines. The two basic operations we use to represent hook-up-direct product and feedback-are generalizations of the classic operations already defined in case of synchronous systems. Our direct product operation allows us to combine two systems having different clocks and our feedback operation can be used to analyze the security of systems where inputs might be blocked.>

Up till now, a few secure models of object oriented databases have been proposed. Most of them support multilevel entities and more or less cover stories. In this paper, we undertake a more natural approach to model object oriented databases supporting multilevel entities which cope with the shortcomings of the previous models, viz the need of trusted mechanisms, the management of polyinstantiated objects and the inconsistency it may introduce in the database. The central idea is to decompose a multilevel object oriented database into a collection of single level databases. Hence, we split up the real universe into worlds corresponding to each security level. These worlds are the views of the universe by users at the corresponding levels, that was the reason of "MultiView" appellation. We present an animation of the MultiView model through creation, updating and consultation of objects. We show how we make use of cover stories without any specific problem. We also give a comparison with previous work and show how difficulties encountered in the earlier models can be avoided by the MultiView model.>

A formal definition is given of what must be considered as secret in a multilevel computer system. The author's point of view drastically differs from the classical approaches since it advocates that all the information contained in the sequence of high level inputs need not be considered as secret. The approach is based on an extended logic involving epistemic and deontic modal operators. This leads to a new security property called nondisclosure on inputs that must really be considered as secret. The author refines this first definition to obtain a stronger property simply called nondisclosure which protects both high level strategies and high level outputs. Finally, a suggestion is given on how one could combine the causality and nondisclosure properties to obtain a decision procedure for analyzing the security of computer systems.>

Data protection in a database involves inference controls which are sometimes of a semantic nature.The notion of neighborhood in a given context between two data is considered and a representation for context and neighborhood is proposed as well as a measurable definition for the neighborhood based on first order mathematical logic.

In reasoning about security policy based on information flow control, two different points of view can be adopted depending on whether explicit permissions or explicit prohibitions are being dealt with. In both cases, an epistemic and deontic logic is used to formally define information a subject is permitted to know. Then it is shown that the causality property can be derived from the explicit permissions point of view and that the noninterference and non-deducibility properties can be derived from the explicit prohibition point of view. However, it is argued that the prohibitions enforced by non-interference or non-deducibility are generally too rigid and lead to too strong security properties. On the other hand, the causality properly only handles internal information flow controls and it must be completed to ensure that the security policy is consistently defined. Hence, the consistency problem is discussed. A general definition and practical conditions are proposed to verify that a security policy is consistent.>

Most security models explicitly (or implicitly) include the tranquillity principle which prohibits changing the security level of a given piece of information. Yet in practical systems, classification of objects may evolve due to declassification and subject current level may evolve according to subject requests. The authors previously proposed a modal logic definition of security whose counterpart is a constraint on the system traces that they called causality. In this paper, they give a generalization of causality which avoids the tranquillity principle. They give an interpretation of their model in the case of a multilevel security policy when the levels can be assigned dynamically. Then they provide efficient conditions to control the dynamic assignment of both the object classification and the subject current level. They propose a comparison of their approach with the nondeducibility generalization. Finally they give several examples of systems where security levels are dynamically assigned.>

It is shown that the analysis of functional dependencies is useful when one wants to decompose a multilevel relation in a collection of single-level relations. The decomposition of a multilevel relation into a collection of fourth normal form (4NF) relations according to various functional dependencies is studied. These decompositions are compared to the decomposition algorithms in single-level relations proposed by the Sea View project and by S. Jajodia and R. Sandhu (IEEE Symp. on Security & Privacy, 1991). It appears that the first step of the decomposition algorithms is simply the normalization of the multilevel relation in 3NF (or in 4NF). The authors propose an analysis of functional dependencies that seem natural from a semantical point of view. A multilevel relation is decomposed into 4NF relations according to these functional dependencies, and it is then shown how to decompose these relations into single-level relations. It is thought this analysis provides a good solution to the polyinstantiation problem and that it would lead to correct definitions of update operations.>

In the context of the modal logic of security, confidentiality is defined by the formula KBφ→RBφ that could be read “If B knows φ then B should have the permission to know φ”. We propose a new semantics for the RB modal operator, such that the definition of security would allow a certain number of dependencies (called secure dependencies) between objects of the system. We formally compare this new definition of security with non-interference, non-deducibility and generalized non-interference, especially with respect to assumptions of non-determinism and input-totalness.

In the context of the modal logic of security, confidentiality is defined by the formula K/sub B/ phi to R/sub B/ phi that could be read 'If B knows phi then B should have the permission to know phi '. The authors propose a new semantics for the R/sub B/ modal operator, such that the definition of security would allow a certain number of dependencies (called secure dependencies) between objects of the system. They formally compare this definition of security with non-interference, non-deducibility and generalized non-interference, especially with respect to assumptions on the systems as non-determinism and input-totalness.>