A System for Managing User Obligations

security;obligations

Irwin, Keith ; S. Purushothaman Iyer, Committee Member,Munindar P. Singh, Committee Member,Ting Yu, Committee Chair,Ping Ning, Committee Member,Irwin, Keith ; S. Purushothaman Iyer ; Committee Member ; Munindar P. Singh ; Committee Member ; Ting Yu ; Committee Chair ; Ping Ning ; Committee Member

University:North Carolina State University

关键词: security;    obligations;   

Others  :  https://repository.lib.ncsu.edu/bitstream/handle/1840.16/5170/etd.pdf?sequence=1&isAllowed=y

美国|英语

来源: null

【 摘 要 】

As computer systems become a more pervasive part of our societies, actions within those computer systems are becoming increasingly governed by complex policies such as laws, corporate policies, and legal agreements such as data sharing agreements and privacy policies. These policies impose both requirements about what may or may not be done and about what must be done. Current security policies may be able to manage restrictions on actions, but they are not sufficient to describe actions which are required. We examine herein the idea of user obligations, which are actions which are required of the users, but which the system cannot directly cause to occur.We propose a system for the management of user obligations. This system should both ensure that obligations are assigned in a manner such that it will be possible for them to be fulfilled and allow users of a system to know what they are required to do. We present an abstract formal model of such a system. We examine a number of aspects of such a system, principally including the maintenance of an acceptable system state, the assignment of blame when users fail to fulfill their obligations, and providing adequate feedback to users when their actions are rejected. For each of these aspects, we present formal definitions to define the range of acceptable behavior. We also provide a more specific and concrete model of one possible user obligations management system and develop algorithms for that model. We do this in order to show the practicality of our formal models and properties.