[4-13]Modeling and Management of Obligations in Security Policies
Date:2010-04-08
Title: Modeling and Management of Obligations in Security Policies
Speaker: Ting Yu
Associate Professor
Department of Computer Science
North Carolina State University
WEB: http://www.csc.ncsu.edu/faculty/yu/
Time: 2:30pm, Tuesday, April 13
Venue: Lecture room, Level 3 Building #5, Institute of Software, CAS
Abstract:
The correct behavior and reliable operation of a system relies not only on what users can permitted to do, but oftentimes on what users are required to so. Such obligatory actions are integral to the security procedures of many enterprises. The management of obligations in security policies imposes significant challenges since obligations bear quite different properties from traditional access control. For example, obligation fulfillment cannot be enforced. Also, obligations may interfere with future authorization states which must be counted to ensure their consistency.
In this talk, we present the design of a framework to systematically manage user obligations and their interactions with security policies, including obligation modeling, security objectives, and security checking and maintenance. The framework is centered around the concept of accountability, which articulates the dependency between obligation and authorizations. We present the formal definition of accountability and discuss how to ensure accountability as a security objective in a system.
About the speaker:
Ting Yu is an associate professor in the Department of Computer Science, North Carolina State University. Ting Yu obtained in BS from Beijing University (1997), MS from University of Minnesota (1998) and Ph.D. from University of Illinois at Urbana-Champaign (2003), all in computer science. His main research area is in information security, with a focus on trust management, data privacy and anonymization , and security and privacy in social networks. He was the recipient of David J. Kuck Outstanding Ph.D. Thesis Awards, University of Illinois at Urbana-Champaign (2003), and the National Science Foundation CAREER Award (2008).