Redirection policies for mission-based information sharing

Abstract

When an access decision function denies a data access request by a mission participant in a mission-critical situation, the mission often suffers. In this paper, we propose a sharing control mechanism that computes and executes requests that are mission-related to denied requests. We extend the Flexible Authorization Framework (FAF) with predicates and hierarchies that permit us to specify authorization rules over denied requests and mission-specific relationships. We illustrate our techniques using a prototypical information sharing scenario, namely an emergency first-responder scenario.

Regulating Exceptions in Healthcare Using Policy Spaces

“…Also our solution never changes users classifications or privileges for managing emergencies or critical events, but it defines policies to be considered in requests that do not satisfy traditional access control policies. Keppler et al [17] discuss the problem of managing requests that are denied, by providing a range of other possible actions to use in emergencies situations. The framework extends the Flexible Authorization Framework (FAF) [16] with a sharing policy language for request and data redirection.…”

“…Policies in E U should be simple and must always grant access according to the break the glass principle since the promptness in reacting against exceptions is fundamental for preserving patients health. As a consequence, we adopt a solution different from the work in [17] where the concept of access request redirection is introduced to allow denied accesses in case of emergencies. In particular, space E U regulates access by providing post-incident capabilities (i.e., auditing) to be used subsequently to better redistribute policies and requests among the spaces.…”

Using a Trust Inference Model for Flexible and Controlled Information Sharing During Crises

“…Much of the existing research on information sharing during crises has extensively addressed the need for secure access, focusing on comprehensive policy designs and analysis and efficient management of users' privileges and privacy. Recent studies found that in mission-critical systems, e.g., military, firefighting or supervisory control and data acquisition (i.e., computerized monitoring and controlling system), conventional access control mechanisms may be too rigid for urgent information-sharing scenarios and often fail to provide adequate support for access in non-routine, critical situations (Cheng, Rohatgi, Keser, Karger, Wagner, & Reninger, 2007;MITRE Corp., 2004;Swarup, Seligman, and Rosenthal, 2006;Keppler, Swarup, and Jajodia, 2006;Singh, Sanders, Nicol, and Seri, 2006). In critical infrastructures such as utility networks, oil and gas pipelines, and disaster and anti-terrorist communications, there is an increasing need to secure the information collected from and about the infrastructure, and yet to be able to allow flexible data sharing to facilitate problem-solving.…”

“…These problems are unique and challenging in emergency and crisis situations because of the dynamic nature of shared data and users. Several notable papers have proposed interesting solutions to the problem of flexible and controlled information sharing (Cheng et al 2007;MITRE Corp., 2004;Swarup et al, 2006;Keppler et al, 2006;Tamassia, Yao, and Winsborough, 2004;Yao, Frikken, Atallah, and Tamassia, 2006;Yao, Tamassia, and Proctor, 2005). The MITRE Corp. (2004) report presented a tokenized access framework and an economic model for regulating the tokens.…”

“…Despite the name, the work is not based on fuzzy logic, but rather on a new probabilistic formulation of MLS model that supports quantified access decisions. Keppler et al (2006) developed a Flexible Authorization Framework that redirects mission-related denied requests to corresponding entities who may serve as an override authority, enabling dynamic information sharing.…”