Proactive enforcement of provisions and obligations

Publikation: Bidrag til tidsskriftTidsskriftartikelForskningfagfællebedømt

We present an approach to the proactive enforcement of provisions and obligations, suitable for building policy enforcement mechanisms that both prevent and cause system actions. Our approach encompasses abstract requirements for proactive policy enforcement, a system model describing how enforcement mechanisms interact with and control target systems, and concrete policy languages and associated enforcement mechanisms. As examples of policy languages, we consider finite automata and timed dynamic condition response (DCR) graphs. We use finite automata to illustrate the basic principles and DCR graphs to show how these principles can be adapted to a practical, real-time policy language. In both cases, we show how to algorithmically determine whether a given policy is enforceable and, when this is the case, construct an associated enforcement mechanism. Our approach improves upon existing formalisms in two ways: (1) we exploit the target system's existing functionality to avert policy violations proactively, rather than compensate for them reactively; and (2) rather than requiring the manual specification of remedial actions in the policy, we deduce required actions directly from the policy.

OriginalsprogEngelsk
TidsskriftJournal of Computer Security
Vol/bind32
Udgave nummer3
Sider (fra-til)247-289
ISSN0926-227X
DOI
StatusUdgivet - 2024

Bibliografisk note

Publisher Copyright:
© 2024 - IOS Press. All rights reserved.

ID: 396987433