Declassification policy management in dynamic information systems
Résumé
Standard multilevel security (MLS) policies lack flexibility as data classification is considered static. Previous works have addressed this issue and defined declassification requirements, especially in programming languages using a language-based security approach. In this paper, we suggest a different approach. We show how to define and enforce declassification policies in databases, seen as sets of logical facts. We first define an information flow control model where data classification may dynamically change. This model combines both confidentiality and integrity requirements to enforce security. We then specify how to enforce declassification policies. Our approach relies on Event-Condition-Action (ECA) rules and provides means to manage the four basic dimensions of declassification, namely the \textit{what?, who?, where? and when?} which respectively refer to modeling information to be declassified, entities responsible for declassification, localization of the declassification and contextual conditions that control declassification. We formalize and specify our declassification policies and prove it safe and secure with respect to the information flow control model.