A Logic for Auditing Accountability in Decentralized Systems

Abstract

We propose a language that allows agents to distribute data with usage policies in a decentralized architecture. In our framework, the compliance with usage policies is not enforced. However, agents may be audited by an authority at an arbitrary moment in time. We design a logic that allows audited agents to prove their actions, and to prove their authorization to posses particular data. Accountability is defined in several flavors, including agent accountability and data accountability. Finally, we show the soundness of the logic.

Correct Audit Logging: Theory and Practice

“…Other work applies formal methods (including predicate logics [16,10], process calculi and game theory [28]) to model, specify, and enforce auditing and accountability requirements in distributed systems. In that work, audit logs serve as evidence of resource access rights, an idea also explored in Aura [39] and the APPLE system [22].…”

Distributed Accountability for Data Sharing in Cloud

“…But it has limitation that data processed on SP is in unencrypted at the point of processing so there is a risk of data leakage. In [4], the author gives a language which permits to serve data with policies by agent; agent should prove their action and authorization to use particular data. In this logic data owner attach Policies with data, which contain a description of which actions are allowed with which data, but there is the problem of Continuous auditing of agent, but they provide solution that incorrect behavior.…”

An Audit Logic for Accountability

“…These definitions allow an authority to audit agents, to establish whether the agent was allowed to do the actions he did. In previous work [6], we defined several notions of agent and data accountability, but without checking for obligations nor conditions. We did not have logs of agents either.…”

“…It is our belief that in many emerging scenarios active policy enforcement is infeasible. This paper builds on the preliminary work reported in [6]. In particular, we provide several extensions, the most notable of which are:…”

“…Agents can create (by refinement) new policies from existing ones, before passing them to other agents. In contrast, in [6] the only policies allowed are those that are explicitly stated by the data owner.…”