researResearch - Télécom Bretagne

h Research
9
RESEARCH
Main achievements of the project
Security policy expression
The work aimed at expanding the expressiveness
of the OrBAC 1 model and the functions of the
MotOrBAC prototype (a support tool for
expressing a security policy with the OrBAC
model) continues within the framework of the
ANR Polux and Fluor projects. It consists notably
of integrating both access control and information
flow control requirements into the OrBAC model
by using particular contexts enabling control of
domain transitions [1]. We have also defined a
general delegation and revocation of rights model
and shown that this model is more expressive
than the other existing models (thesis under joint
supervision with SupCom Tunis). Finally, we have
formalised a model with a wide range of
obligation expressions, permitting notably the
specification of obligations with deadlines, of
persistent obligations and of group obligations.
This formalism allows expansion of the OrBAC
model in order to express security policies
integrating usage control requirements (control
before, during or after use of the resource).
Methodology for the deployment of
security policies
The MotOrBAC prototype is based on a modular
architecture which allows easy integration of new
functions in order to deploy a security policy in the
form of plug-ins. We have notably formalised the
deployment of security policies that depend on
contextual conditions (for example, time delays or
location or intrusion events) [2]. In this case,
MotOrBAC can be used to manage the contextual
conditions and dynamically redeploy the policy
when the context changes. We have developed
another plug-in enabling translation of OrBAC
requirements into the oasis standard XACML , a
language to express access control policies. This
work is in the process of being integrated into the
negotiation of security policies architecture XENA,
developed within the RNRT “Politess” project
framework [9]. We are currently studying the
deployment of information flow control
requirements based on domain partitioning, such
as those currently embedded in some secured
versions of Linux, in particular Security Enhanced
Linux.
Implementing security
The work carried out under a thesis funded by the
initiative programme « Reseaux autonomes and
spontanés » (Autonomous and Spontaneous
Networks) supported by the Telecom Institute
concerns interoperability between organisations
with different security policies. The work focused
on the secure management of interoperability
based on the definition of contracts. This notion of
a contract combined with an ontological mapping
enables derivation of interoperability policies
between organisations and has been integrated
into O2O (Organization to Organization), an
extension of the OrBAC model. We are also
working on securing applications using aspect
weaving techniques as in the AOP (Aspect
Oriented Programming) approach. This approach
is effective, each of the aspects woven into an
application corresponding to a call to the API of
MotOrBAC to carry out the required security
checks.
Secure content distribution
Within the P2Pim@ges project which is supported
by the business and research pole « Images et
Reseaux (Images and Networks)» we study the
implementation of security requirements in peer
to peer(P2P) systems. Control of content
distribution relies on DRM (Digital Right
Management) techniques via the implemention of
the OPA (Onion Policy Administration) model and
the FORM (Federated Right Expression Model).
This approach is integrated in the Protekto
platform which combines the functions of identity
management based on single authentication
mechanisms (Single Sign On) with management
of access to content authorisation as well as the
distribution of that content.
Network Security
In the context of work related to the development
of services through the Parlay/Parlay X bridge, the
location service constitutes one of the new
services creating heightened interest for
operators. Privacy treatment and management is
a central consideration. An improved treatment of
pseudonyms was proposed and integrated into an
179
1) OrBAC : Organization Based Access Control
2) XACML : eXtensible Access Control Markup Language