Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

ACM, vol. 18, issue 6, pages 333–340, June1975[2] “Snort - The Open Source NetworkIntrusion Detection System,” inhttp://www.snort.org/[3] Georges Adouko, François Charot, SylvainGombault, Tony Ramard and ChristopheWolinski. “Panorama des algorithmes efficaceset architectures matérielles pour le filtrageréseau haut débit et la détection d'intrusions ».MAJECSTIC 2006, Lorient, France, 22--24November 2006.[4] Georges Adouko and François Charot, andChristophe Wolinski. « Exploitation optimaledes circuits reconfigurables FPGA pour la miseen oeuvre d'un moteur de recherche demotifs ». SYMPA 2008, Fribourg, Allemagne,Février 2008.[5] Clément Cresteaux, Thomas Gautier,Mamadou Sanoussy Diallo, Pierre Tasson.« Projet Snort : Ajout d’un préprocesseur ».Rapport de projet Master 2 Université deRennes 1, Février 2007.Consistency and interoperability in security policiesResearch Staff : Frédéric Cuppens, Nora Cuppens-Boulahia – PhD. Student: Céline ComaKeywords : security policy, secured interoperability, OrBAC, Ontology, Sphere of authorityApplications : Web service securityPartners & Funding : partially funding from the French RNRT project Politess and by a grant fromthe Institut TELECOMIntroductionCurrent information systems are more andmore distributed and require more interactionswith external services to achieve businesscontinuity. In this context, we have to securethe access to and usage of exchangedinformation and, insure that each partyinvolved in some interoperability session mustat least maintain its security level. Toguarantee good interoperability exchanges,organizations need to share information withother participant about the services theyprovide. In addition, to be compliant withsecurity requirements during interoperability,security policies have to be dynamic. Onepurpose of our recent works is to provide thisdynamic behavior by taking care about contextof access parameters. The context-awaresecurity requirements may be met by using acontextual access control model to define thesecurity policy of each party involved in theinteraction, and OrBAC (Organization basedAccess Control) is an adequate model for thispurpose. Elaborating an ontology basedsecurity model provides a mean to ensuresharing of understandable knowledge, inparticular knowledge needed to derive theauthorized accesses and usages during theinteroperability sessions. We thus suggestcontext ontology to be combined with anontological representation of the OrBAC modeland show how it can be used to ease thesecurity rules definition and derivation duringinteroperability sessions.RealizationWe suggest a formal approach called O2O(Organization to Organization) to deal withaccess control in an interoperability context. Itis based on the concept of Virtual PrivateOrganization (VPO) that enables anyorganization undertaking an interoperationwith other organizations to keep control overthe resources accessed during theinteroperability phases. Thus, using O2O, eachorganization can define and enforce its owninteroperability security policy. Thisinteroperability security policy defines howsubjects from some organization can accessand use resources owned by otherorganizations in the VPO. In the O2Oapproach, VPO policies are expressed by useof the OrBAC model. Its built-in confinementprinciple ensures a secure interoperation andits structure based on organizations, roles,activities, views and contexts makesspecifications of fine grained access controleasier. In OrBAC due to the confinementprinciple, the scope of every security rule isPracom’s report 2006 53