Logo image
Back
On the management of user obligations
Conference proceeding

On the management of user obligations

Murillo Pontual, Omar Chowdhury, William Winsborough, Ting Yu and Keith Irwin
Proceedings of the 16th ACM symposium on access control models and technologies, pp.175-184
SACMAT '11
06/15/2011
DOI: 10.1145/1998441.1998473

View Online

Abstract

This paper is part of a project investigating authorization systems that assign obligations to users. We are particularly interested in obligations that require authorization to be performed and that, when performed, may modify the authorization state. In this context, a user may incur an obligation she is unauthorized to perform. Prior work has introduced a property of the authorization system state that ensures users will be authorized to fulfill their obligations. We call this property accountability because users that fail to perform authorized obligations are accountable for their non-performance. While a reference monitor can mitigate violations of accountability, it cannot prevent them entirely. This paper presents techniques to be used by obligation system managers to restore accountability. We introduce several notions of dependence among pending obligations that must be considered in this process. We also introduce a novel notion we call obligation pool slicing, owing to its similarity to program slicing. An obligation pool slice identifies a set of obligations that the administrator may need to consider when applying strategies proposed here for restoring accountability. The paper also presents the system architecture of an authorization system that incorporates obligations that can require and affect authorizations.
 authorization obligations RBAC accountability policy

Details

Metrics

27 Record Views
Logo image