![](bgc.png)
add support for access control policies with obliga-
tions and a framework for the specification and en-
forcement of data handling policies is presented in
(Ardagna et al., 2008). These works do not address
the dynamic analysis of usage control policies.
7 CONCLUSION
This paper introduces an approach for the formal
analysis of usage control policies and study of their
application on target domains. Thus, our work is a
first step in providing policy officers a valuable means
to formally verify the correctness of specified poli-
cies before their deployment. Furthermore, we have
identified and formalized several usage control spe-
cific properties and automated their verification.
This work can be extended to support structured
policies with pre-defined sets of basic entities (El-
rakaiby et al., 2012). We also intend to investigate the
use ofC+
timed
(Craven and Sergot, 2005) to provide a
more elegant representation of delays and deadlines,
and to design heuristics for our approach to make
model checking scale better to real-world scenarios.
REFERENCES
CCalc. http://www.cs.utexas.edu/∼tag/cc/.
iCCalc. http://www.doc.ic.ac.uk/∼rac101/iccalc/.
Ardagna, C. A., Cremonini, M., De Capitani di Vimercati,
S., and Samarati, P. (2008). A privacy-aware access
control system. JCS, 16(4):369–397.
Armando, A., Giunchiglia, E., Maratea, M., and Ponta, S. E.
(2012). An action-based approach to the formal spec-
ification and automatic analysis of business processes
under authorization constraints. Journal of Computer
and System Sciences, 78(1):119–141.
Armando, A., Giunchiglia, E., and Ponta, S. E. (2009). For-
mal specification and automatic analysis of business
processes under authorization constraints: An action-
based approach. In TrustBus, volume 5695 of LNCS,
pages 63–72. Springer.
Artikis, A. and Sergot, M. (2010). Executable specification
of open multi-agent systems. Logic Journal of IGPL,
18(1):31–65.
Artikis, A., Sergot, M. J., and Pitt, J. (2007). An executable
specification of a formal argumentation protocol. Ar-
tificial Intelligence, 171(10-15):776 – 804.
Babb, J. and Lee, J. (2013). Cplus2asp: Computing action
language c+ in answer set programming. Logic Pro-
gramming and Nonmonotonic Reasoning, page 122.
Becker, M. Y. and Nanz, S. (2007). A logic for state-
modifying authorization policies. In ESORICS, vol-
ume 4734 of LNCS, pages 203–218. Springer.
Bouali, A., Gnesi, S., and Larosa, S. (1994). The integration
project for the JACK environement. Bulletin of the
EATCS, 54:207–223.
Casolary, M. (2011). Representing the language of the
causal calculator in answer set programming. PhD
thesis, Arizona State University.
Craven, R., Lobo, J., Ma, J., Russo, A., Lupu, E., and Ban-
dara, A. (2009). Expressive policy analysis with en-
hanced system dynamicity. In ASIACCS, pages 239–
250. ACM.
Craven, R. and Sergot, M. (2005). Distant causation in C+.
Studia Logica, 79(1):73–96.
Dworschak, S., Grell, S., Nikiforova, V., Schaub, T., and
Selbig, J. (2008). Modeling biological networks by
action languages via answer set programming. Con-
straints, 13(1-2):21–65.
Elrakaiby, Y., Cuppens, F., and Cuppens-Boulahia, N.
(2012). Formal enforcement and management of obli-
gation policies. DKE, 71(1):127 – 147.
Ferraiolo, D., Cugini, J., and Kuhn, D. R. (1995). Role-
based access control (rbac): Features and motivations.
In ACSAC, pages 241–48. ACM.
Gebser, M., Grote, T., and Schaub, T. (2010). Coala: a
compiler from action languages to ASP. In Logics in
Artificial Intelligence, pages 360–364. Springer.
Gelfond, M. and Lifschitz, V. (1998). Action languages.
Electronic Transactions on AI, 3(16).
Giunchiglia, E., Lee, J., Lifschitz, V., McCain, N., Turner,
H., and Lifschitz, J. L. V. (2004). Nonmonotonic
causal theories. Artificial Intelligence, 153:49–104.
Hilty, M., Pretschner, A., Basin, D., Schaefer, C., and Wal-
ter, T. (2007). A policy language for distributed usage
control. In ESORICS, volume 4734 of LNCS, pages
531–546. Springer.
Irwin, K., Yu, T., and Winsborough, W. H. (2006). On the
modeling and analysis of obligations. In CCS, pages
134–143. ACM.
Li, N., Chen, H., and Bertino, E. (2012). On practical spec-
ification and enforcement of obligations. In Proceed-
ings of the Second ACM Conference on Data and Ap-
plication Security and Privacy, CODASPY ’12, pages
71–82, New York, NY, USA. ACM.
Li, N. and Tripunitara, M. V. (2006). Security analysis in
role-based access control. TISSEC, 9(4):391–420.
Lifschitz, V. (1999). Action languages, answer sets, and
planning. In The Logic Programming Paradigm,
pages 357–373. Springer.
Lupu, E. C. and Sloman, M. (1999). Conflicts in
policy-based distributed systems management. TSE,
25(6):852–869.
Pretschner, A., Ruesch, J., Schaefer, C., and Walter, T.
(2009). Formal analyses of usage control policies. In
ARES, pages 98–105. IEEE.
Ranise, S. and Armando, A. (2012). On the automated
analysis of safety in usage control: a new decidability
result. In NSS’12, pages 15–28, Berlin, Heidelberg.
Springer-Verlag.
Samarati, P. and de Vimercati, S. C. (2001). Access con-
trol: Policies, models, and mechanisms. In Founda-
DynamicAnalysisofUsageControlPolicies
99