![](bgb.png)
of information, e.g., imposing that certain informa-
tion may only be used - or copied - a certain num-
ber of times. Related to the sharing of data, but
not strictly related to analysis, (Lupu and Sloman,
1999; Scalavino et al., 2009; Scalavino et al., 2010)
present an evaluation scheme for sharing data in a se-
cure way in a crisis management scenario, through
opportunistic networks. Work in (Liang et al., 2013)
presents a conflict-detection tool based on first order
logic, whose performances are compared to the ones
in (Huang and Kirchner, 2011), where the authors use
coloured Petri nets process for policy analysis. Our
performances outcome are competitive with respect
to those two results. A popular and general approach
for solving conflicts among privacy rules is the one
adopted by the eXtensible Access Control Markup
Language (XACML) and its associated policy man-
agement framework (OASIS, 2010). XACML poli-
cies (or policy sets) include a combining algorithm
that defines the procedure to combine the individual
results obtained by the evaluation of the rules of the
policy (of the policies in the policy set). Work in (Lu-
nardelli et al., 2013; Matteucci et al., 2012a) is an
example on how standard XACML combining algo-
rithms can be extended, e.g., evaluating - through well
known techniques for multi-criteria decision mak-
ing (Saaty, 1990) - how much the attributes in a policy
are specific in identifying the subject, the object, and
the environment of the policy.
6 CONCLUSIONS
In this paper, we have considered electronic con-
tracts consisting of several data sharing rules, possibly
edited by more than one actor. Aiming at signaling
to the editors potential conflicts among the rules, we
have designed and developed an analysis tool, which
evaluates set of rules with different effect (access
granted/access denied) under all the contextual condi-
tions which may arise from the vocabulary and prop-
erties associated to the DSA. The performance results
indicate the feasibility of the application of our pro-
posal, for scenarios featuring up to hundreds of rules
and up to dozens of terms in the vocabulary (which,
to the best of our expertise in the field of healthcare,
public administration, and business scenarios, repre-
sent realistic numbers for DSA-based practical appli-
cations). A possible improvement, which we leave for
the future, is to optimise the analysis by paralleling it
into three different processes, for authorizations, pro-
hibitions, and obligations.
ACKNOWLEDGEMENTS
Partially supported by the FP7 EU project Coco Cloud
[grant no. 610853] and the H2020 EU project C3ISP
[grant no. 700294].
REFERENCES
Arenas, A. et al. (2010). An Event-B Approach to Data
Sharing Agreements. In Integrated Formal Methods,
pages 28–42. Springer.
Bicarregui, J. et al. (2008). Towards Modelling Obligations
in Event-B. In ABZ, pages 181–194.
Casassa Mont, M., Matteucci, I., Petrocchi, M., and Sbodio,
M. L. (2015). Towards safer information sharing in the
cloud. Int. J. Inf. Sec., 14(4):319–334.
Clavel, M. et al., editors (2007). All About Maude - A
High-Performance Logical Framework, How to Spec-
ify, Program and Verify Systems in Rewriting Logic,
volume 4350 of LNCS. Springer.
Damianou, N., Dulay, N., Lupu, E., and Sloman, M. (2001).
The Ponder policy specification language. In Policies
for Distributed Systems and Networks, POLICY ’01,
pages 18–38. Springer-Verlag.
De Nicola, R., Ferrari, G. L., and Pugliese, R. (2000). Pro-
gramming access control: The KLAIM experience. In
CONCUR 2000 - Concurrency Theory, pages 48–65.
Ferraiolo, D. and Kuhn, R. (1992). Role-based access con-
trol. In NIST-NCSC National Computer Security Con-
ference, pages 554–563.
Hansen, R. R., Nielson, F., Nielson, H. R., and Probst, C. W.
(2008). Static Validation of Licence Conformance
Policies. In ARES, pages 1104–1111.
Huang, H. and Kirchner, H. (2011). Formal specification
and verification of modular security policy based on
colored Petri nets. IEEE Trans. Dependable Secur.
Comput., 8(6):852–865.
Jin, J., Ahn, G.-J., Hu, H., Covington, M. J., and Zhang, X.
(2011). Patient-centric authorization framework for
electronic healthcare services. Computers & Security,
30(2-3):116–127.
Lazouski, A., Martinelli, F., Mori, P., and Saracino, A.
(2014). Stateful usage control for Android mobile de-
vices. In Security and Trust Management, pages 97–
112. Springer International Publishing.
Liang, X. et al. (2013). A conflict-related rules detection
tool for access control policy. In Frontiers in Internet
Technologies, pages 158–169. Springer.
Lunardelli, A., Matteucci, I., Mori, P., and Petrocchi, M.
(2013). A prototype for solving conflicts in XACML-
based e-Health policies. In 26th IEEE Symposium on
Computer-Based Medical Systems, pages 449–452.
Lupu, E. C. and Sloman, M. (1999). Conflicts in policy-
based distributed systems management. IEEE Trans.
Softw. Eng., 25(6):852–869.
Martinelli, F., Matteucci, I., Petrocchi, M., and Wiegand, L.
(2012). A formal support for collaborative data shar-
ing. In Availability, Reliability, and Security, pages
547–561.
Analysis of Data Sharing Agreements
177