Search

International audience; The evolution of markets and the high volatility of business requirements put an increasingemphasis on the ability for systems to accommodate the changes required by neworganizational needs while maintaining security objectives satisfiability. This is even moretrue in case of collaboration and interoperability between different organizations and thus between their information systems. Usual solutions do not anticipate interoperability security requirements or do it in a non satisfactory way. In this chapter, we propose a contract and compatibility principles within a formal framework O2OSecure to achieve a secure interoperation.Contracts are used to explicitly represent the rules that determine the way interactionbetween organizations must be controlled to satisfy secure accesses to resources. Compatibility relations make it possible to derive interoperability security policies. We specify all the wheelwork of interoperation between organizations which might manage their security policies using access control model RBAC and/or OrBAC.Furthermore, as interoperation may lead to a lot of exchanges of information beforeand during the interoperability session, in particular those related to credentials and securitypolicies, we propose to ensure privacy protection to use the O2O licence administrativeview and an XML block based access control technique to obfuscate some of the informationexchanged.

National audience; Given the growing complexity of information systems and the difficult task of security policy enforcement, system administrators need simple and powerful security management tools. This article presents the second version of MotOrBAC, a tool that embeds policy specification and administration in a same model. MotOrBAC is able to simulate and analyze a security policy specified using the OrBAC model. It also implements the AdOrBAC model which is used to administrate OrBAC. This article presents why the OrBAC model has been chosen to implement such tool. We also present the OrBAC application programming interface used by the new version of MotOrBAC and how it can be integrated into other applications to enforce an OrBAC policy.