Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

RealizationFigure 1 shows a classification we havedefined in Polux of the various requirements asecurity policy may contain. We are currentlydefining an integrated formalism to specifythese different requirements in a uniqueframework.A new version of MotOrBAC has been writtenin pure java and relies on the OrBAC java API.The OrBAC java API uses the Jena library torepresent the OrBAC policy through an RDFgraph and uses the Jena inference engine. TheOrBAC java API has been created to allowdeveloppers to integrate the OrBAC securitymodel into their applications.Our work on MotOrBAC also focuses on theproblem of policy deployment. Actually we areworking on policy translation mechanisms tointegrate into MotOrBAC the possibility totranslate parts of a concrete policy inferedfrom an abstract OrBAC policy into variouslanguages used to configure security softwares(iptables for instance).Figure 1: Security policy structureThe approach suggested in the POLUX projectis to define this framework as an extension ofthe OrBAC model [1]. For a system to bedeveloped, OrBAC describes the permissions orprohibitions for people to any of the resourcesof the system (it may apply to configure afirewall as well as to define who can access agiven service or database). These rules specifypermissions or prohibitions that apply only tospecific circumstances, called contexts [2].OrBAC also provides means to specify thedifferent security policies applicable to thevarious parts of an organization (suborganizations).At the end of this specificationprocess, the security policy specifies whatshould be permitted or prohibitied in thesystem, in function of contexts, roles, activitiesand views.An administration model for the OrBAC model,called AdOrBAC [3] has also been defined anda support tool called MotOrBAC has beenimplemented and is available as an opensource software. MotOrBAC [4] is an opensource tool which can be used to write securitypolicies expressed using the OrBAC model. Itprovides functionalities to edit a policy, todetect and solve the potential policy conflictsand to simulate the policy.ConclusionWe plan to further develop the OrBAC model,especially to specify information flowrequirements, usage control requirements andreaction requirements. The MotOrBAC tool kitwill be extended to support the specification ofthese different requirements.References[1] A. Abou El Kalam, R. El Baida, P. Balbiani,S. Benferhat, F. Cuppens, Y. Deswarte, A.Miège, C. Saurel and G. Trouessin.Organization Based Access Control. IEEE 4thInternational Workshop on Policies forDistributed Systems and Networks (Policy2003), Lake Come, Italy, June 2003.[2] F. Cuppens and A. Miège. Modelingcontexts in the Or-BAC model . 19th AnnualComputer Security Applications Conference,Las Vegas, December 2003.[3] F. Cuppens et A. Miège. AdministrationModel for Or-BAC. International Journal ofComputer Systems Science and Engineering(CSSE), 19(4), Mai 2004.[4] F. Cuppens, N. Cuppens-Boulahia et C.Coma. MotOrBAC : un outil d’administration etde simulation de politiques de sécurité. SAR-SSI. Seignosse, France, Juin 2006.34 Extract of Pracom’s Annual Report 2008