Towards Unifying Semantic Constraints and Security Constraints in Distributed Information Systems

Transcription

1 Towrds Unifying Semntic Constrints nd Security Constrints in Distributed Informtion Systems Disserttion von Brbr Sprick zur Erlngung des Grdes eines Doktors der Nturwissenschften der Universität Dortmund m Fchbereich Informtik Dortmund 2003

2 Tg der mündlichen Prüfung: 6. Oktober 2003 Dekn: Prof. Dr. Bernhrd Steffen 1. Gutchter: Prof. Dr. Jochim Biskup 2. Gutchter: Prof. Dr. Ernst-Erich Doberkt

3 Acknowledgement My work would not hve been possible without the help, the guidnce nd the ptience of lot of people. First nd foremost, I wish to thnk my supervisor Jochim Biskup for his guidnce, his encourgement nd his ptience. His extensive wy of giving comments on nd mking suggestions for my work hs lwys significntly nd positively influenced both form nd content of the work. I especilly owe lot of thnks to my collegue Rlf Menzel. Rlf ws lwys willing to discuss ides s well s technicl detils with me. The discussions with him were invluble for my understnding of the interction of knowledge nd ction. Mny times when I got stuck in proof he helped me with his stright forwrd thinking nd with his bility to rrnge my ides. It ws gret plesure to work with him. Very importnt for the development of the tbleu system were the fruitful discussions with Hubert Wgner. When I hd no ide how to tckle the interction of knowledge nd belief in the tbleu system, he helped me with his brod knowledge bout logics in generl nd bout tbleu systems. The discussions with him were lwys motivting nd invluble for my work. I thnk Professor Doberkt for greeing to be the second referee of this work nd for his comments on the text. I would lso like to thnk my other collegues, Christin Altenschmidt, Ulrich Flegel, Jürgen Freitg, Yücel Krbulut, Thoms Leineweber, Frnk Müller, Jörg Prthe nd Sndr Wortmnn for the good coopertion in the group nd for ll the support in my fights with the computers. Especilly Frnk, with his mthemticl bckground, ws of gret help for detils of the numerous proofs in my work. I m most grteful for ll the support I got from Sudhir Agrwl, for his morl support, for listening to ll my problems, to ech dy s success nd filures nd for his enthusism for discussing ides. My flt mtes Sbine Kühle nd Birgitt Wolf showed lot of considertion for me nd ptiently listened to ll my reports bout filures. They lwys cheered me up in long evenings with good food nd wine. Nturlly, my work would not hve been possible without my prents. I owe them lot of thnks for their untiring morl support. 3

4 Abstrct Modern informtion systems must respect certin restrictions in order to gurntee the proper nd desired functionlity. Semntic constrints help to prevent inconsistencies in the stored dt resulting from fulty updtes. Security constrints re to mintin integrity, secrecy nd vilbility over updtes nd over queries. This thesis designs unifying frmework for the specifiction of semntic constrints nd security constrints in informtion systems in order to study interctions between them. We consider n informtion system s distributed, rective system in which ech ctor nd ech object cts utonomously nd concurrently. Actors gin knowledge by performing red opertions on objects nd they my updte the content of n object by performing updte opertions. To execute red or updte opertions, ctors need execute rights tht cn be grnted or revoked by other ctors. This view of n informtion system is cptured in computtionl model. In this model, we consider ech component of the informtion system, ctors s well s objects, uniformly s sequentil gent tht performs opertions utonomously nd jointly with other sequentil gents. Ech gent is ffilited with set of locl propositions nd set of locl opertions s well s with reltions tht cpture the gent s knowledge nd belief. An gent s knowledge is determined completely by its locl stte. Chnge in knowledge of n gent is due to opertions performed by the gent. Interction between knowledge nd opertions is cptured by the requirement tht the enbling nd the effect of n opertion is completely determined by the knowledge of the cting gents. Knowledge of gents cn be chnged only by opertions in which they prticipte. We define temporl nd epistemic specifiction lnguge with temporl nd epistemic opertors. The logic provides for ech gent locl next nd until opertors s temporl opertors nd locl knowledge nd belief opertors s epistemic opertors. We develop modl tbleu bsed proof system for subset of the logic nd show its soundness. Completeness cn be shown only for smller, but still resonble subset of the logic, decidbility remins n open question. The min difficulty of the tbleu system rises from the interction requirement between knowledge nd ction. In detiled exmple we demonstrte how the frmework cn be used for specifying semntic constrints nd security constrints in informtion systems. 4

5 Contents 1 Introduction Vrious Types of Constrints for Informtion Systems Semntic Constrints Security Constrints The Problem Anlysis of the Problem Our Approch Outline of the Thesis Relted Work Temporl Aspects in Distributed Informtion Systems Epistemic Aspects in Distributed Systems Deontic Aspects Combintion of Deontic nd Epistemic Aspects Our View of n Informtion System Sttic Aspects Dynmic Aspects Concerning Control Dynmic Aspects Concerning Knowledge nd Belief Summrized View A Temporl nd Epistemic Logic L (Ag,Õ, P) Syntx of the logic L (Ag, Õ, P) Semntics of the logic L (Ag,Õ, P) Properties of the logic L (Ag, Õ, P) A Tbleu Proof System for L (Ag,Õ, P) Introduction to Tbleux Preliminries Tbleu Formule Tbleu Rules Axioms nd Locl Rules Rules Concerning Epistemic Structure

6 Contents Rules Concerning Temporl Structure Interction Between Knowledge nd Action Definition of Tbleux Bsic Properties of Regulr Tbleux Firness on Appliction of Tbleu Rules Soundness nd Completeness of the Tbleu System Soundness Completeness of the Tbleu System Construction of Model M nd stisfying L-embedding A Specifiction Exmple Privcy Oriented Clering for the Germn Helth Cre System Initiliztion Phse Tretment nd Billing Phse Logicl Specifiction of the Billing nd Clering Scheme Sttic Prt of the System Semntic Constrints Temporl Behvior Semntic Constrints Epistemic Behvior Specifiction of Security Constrints Fetures nd Limittions of the Frmework Conclusion nd Outlook Summry Competency of the Frmework Open Problems Bibliogrphy 225 A Nottions 229 B A Tbleu System for L 233 B.1 The Tbleu Rules B.2 Blocks for Rule Applictions C Tbleu Exmple 239 6

7 Chpter 1 Introduction An informtion system models prt of the rel world while respecting certin constrints in order to gurntee the proper nd desired functionlity. These constrints cn be imposed by the rel world s well s by the ppliction context nd cn be declred on the stored dt in the informtion system s well s on the behvior of the system nd its users. Semntic constrints help to prevent the informtion system to hve dt tht is incomptible to the rel world. For exmple, 25 yers old employee cnnot hve work history of 30 yers, ech employee hs socil security number, n employee s slry my not decrese, every person cn either be mle or femle. Since dt incomptible to the rel world my result from fulty updtes, semntic constrints re to be checked during the execution of updte opertions. They restrict the possible (sequences of) updtes in ech stte of the informtion system. Security constrints help to mintin integrity, secrecy nd vilbility over (sequences of ) updtes s well s over queries. For exmple, n employee my not increse her own slry, n dministrtion employee in hospitl my not lter lbortory dt of ptient, secret informtion my not be disclosed to n unclssified user, whenever user queries the system, she must eventully get the requested informtion, 7

8 Chpter 1 Introduction While semntic constrints re concerning the vlues of dt in the informtion system, security constrints re more concerning the circumstnces under which the dt my be modified or disclosed. Some yers go, informtion systems were mostly monolithic: We could ssume tht dt ws stored centrlly in one plce tht there ws one schem for the dtbse which included ll semntic constrints imposed on the dt nd thus tht there ws centrl nd globl control over the system. Over time, the dt stored in informtion systems hs been drmticlly incresing, nd the potentils of combining informtion systems over network hve been growing. So, distributed systems with heterogeneous distributed components becme more nd more importnt. We cn now consider n informtion system s highly distributed system with heterogeneous distributed components. In such systems, it seems unrelistic to ssume nything like globl schem or centrlized mechnism for updtes with enforcement of semntic constrints nd for query evlution. Insted, we hve to ssume tht ech individul component hs only restricted view on the whole system. Accordingly, security is considered s being concerned with the different interests nd views of the vrious components. Here, it seems to be rther undesirble to ssume nything like globl security policy or centrlized supervising mechnisms. Insted, whenever possible, security interests should be enforced by the components utonomously. In the reminder of this thesis, whenever we consider semntic constrints nd security constrints, we will hve to keep in mind tht these constrints re employed in distributed environment. In prticulr, even if n idel observer thinks in terms of globl stte, which, however, is questionble becuse of the problem of synchronized time, in prctice ny component will hve only prtil knowledge bout tht fictitious stte. Our gol is to provide unifying frmework for both kinds of constrints, semntic constrints s well s security constrints declred for distributed informtion systems in order to study interctions between these constrints on the conceptul level t design time in mngeble wy supported by n lgorithmic tool. In the following we review the bsic fetures of the two kinds of constrints tht we hve in mind to provide unifying frmework for both of them. 1.1 Vrious Types of Constrints for Informtion Systems Let us first investigte the vrious types of constrints in informtion systems in order to justify the required fetures of our frmework. 8

9 1.1 Vrious Types of Constrints for Informtion Systems Semntic Constrints Semntic constrints reflect properties of n outside mini-world tht is modeled by the informtion system. There re severl possibilities to clssify these properties: We cn distinguish between properties tht cn be found in the rel world (like An employee of 25 yers ge cnnot hve work history of 30 yers, A person cnnot hve two biologicl mothers or A person hs exctly one birth dte) nd properties tht re be imposed by the ppliction requirements (like Every employee must hve socil security number, A person my get her driving license only fter she is 18 yers old or Every prticipnt of the lb course must be student). Another wy to clssify semntic constrints is to distinguish between sttic constrints, tht re properties reltive to one instnce of the informtion system (like the bove constrints Every employee must hve socil security number, Every prticipnt of the prcticl course must be student or A person my sign n invoice only if she holds the secret signture key) nd dynmic constrints, tht re properties regrding sequence of instnces over time (like The slry of n employee my not decrese, Once bnk ccount exists, it exists forever or A prescription cn be used only once). Semntic constrints re invrints tht need to be mintined by the informtion system whenever the current instnce of the informtion system is chnged by some updte opertion. Further, semntic constrins re intended to support the users of n informtion system when they interpret instnces of system in terms of rel world Security Constrints Security constrints reflect obligtions nd restrictions of humn individuls in the outside mini-world modeled by the informtion system. Their min purpose is to mintin secrecy, integrity, nd vilbility. Mintining secrecy mens preventing the improper disclosure of dt. Users my ccess informtion directly by querying the informtion system or indirectly through logicl conclusions of their knowledge or belief. Thus, we cn distinguish between two types of confidentility. The first type is uthoriztion confidentility, roughly 9

10 Chpter 1 Introduction mening queries should be successfully invoked only by uthorized users. The second type of confidentility roughly mens tht the users knowledge nd belief should comply with the tsk specific restrictions, they should not be ble to infer informtion they re not entitled to know. Mintining vilbility mens voidnce of denil of service. Avilbility hs two spects: Firstly, whenever informtion is requested by user, the system should eventully provide this informtion or, in other words, user knowledge should eventully comply with the tsk specific richness. Secondly, whenever user submits n (updte) opertion, this opertion should eventully be executed. Mintining integrity mens preventing the improper modifiction of dt. In the context of security requirements this cn be seen s uthoriztion integrity : updtes should be successfully invoked only by uthorized users, e.g. in compny, employees my not increse their own slry. Security constrints re invrints tht re to be mintined by the system whenever some opertion sequences re executed on behlf of n ctor. Here, updte opertions (e.g. for mintining integrity) s well s red opertions (e.g. for mintining secrecy) re importnt. Further, security constrints re intended to support system users when they employ the system s communiction tool, e.g. by controlling the flow of informtion. Often we cnnot strictly distinguish mong integrity in the context of security, integrity s semntic constrints, nd integrity required by vilbility. However, in ll the three contexts, we sometimes hve obligtions concerning sequences of opertions: user should eventully invoke required opertion, collection of users should eventully invoke required sequences of opertions or stored dt should eventully rech required sttes. These obligtions cn be seen s wek obligtions: it is not required, tht they lwys re lwys stisfied, or tht they re stisfied immeditely fter some checkpoint. It is only required tht they will eventully be stisfied. Similrly, constrints in the context of vilbility cn be seen s wek constrints: gin, it is only required tht the system hs to execute requested opertions eventully nd not necessrily immeditely. 1.2 The Problem There re subtle interctions of semntic constrints nd security constrints in informtion systems. For exmple, the semntic constrints my demnd tht if some dt is modified, then dt b needs to be modified ccordingly, while the security constrints llow the user to modify only dt but not dt b. Another 10

11 1.3 Anlysis of the Problem exmple could be tht the knowledge bout semntic constrints revels informtion to user tht should be kept secret from her. To gurntee the desired functionlity of n informtion system, the specifiction of the system nd of the constrints should cover the requirements imposed by the rel world nd the ppliction context. It is essentil to investigte the interctions between the vrious types of constrints to ensure the correct design. The question tht rise re: Are the imposed constrints consistent? Does the system description ensure the desired constrints? Interctions of semntic constrints nd security constrints cn be investigted only if they re uniformly expressed in the sme frmework. Our im is to develop such frmework nd to hve n (t lest semi-) utomtic proof tool to nswer the bove questions. 1.3 Anlysis of the Problem An informtion system models prt of the rel world, often clled mini-world. The outside mini-world imposes certin restrictions on the dt stored in its objects. Semntic constrints of n informtion system reflect these restrictions of the modeled mini-world. In section we distinguished between two types of semntic constrints, nmely sttic semntic constrints nd dynmic semntic constrints. Sttic constrints restrict the possible sttes of the informtion system, wheres dynmic constrints restrict possible updtes nd sequences of updtes. Thus, our frmework must be ble to del with sttes nd (sequences of) updtes. The outside mini-world imposes certin obligtions nd restrictions on its ctors. Security constrints of n informtion system reflect these obligtions nd restrictions of the modeled outside mini-world. In section we identified three min types of security constrints, nmely secrecy, integrity, nd vilbility. Secrecy constrints restrict the flow of informtion by keeping trck of the ctors knowledge nd by restricting red ccess to dt. Thus, our frmework must hve notion of ctors knowledge nd of execute rights for red opertions. Integrity constrints restrict the possible updtes nd sequences of updtes by restricting the ctors write ccess to objects. Thus, our frmework must hve notion of execute rights for write opertions. 11

12 Chpter 1 Introduction Avilbility constrints impose obligtions on the system. In wek sense, these obligtions cn be modeled using temporl notions: If user submits n opertion, the system should eventully execute it. Thus, our frmework must hve notion of time. In the context of semntic constrints s well s in the context of security constrints we sometimes tlk bout sequences of opertions. Such sequences cn lso be modeled using temporl notions. Further, the frmework must be ble to formlize ctors, e.g. users, dministrtors etc. These ctors perform opertions, thus we need notion of opertions. Our frmework must lso be cpble of formlizing stored dt, e.g. by formlizing objects whose current stte represents the stored dt. On these objects, opertions re executble. Also, the current stte of the objects my chnge over time by the execution of opertions, which mens tht the stte of objects over time hs to be formlized. As observed bove, opertions cn be of vrious types: queries or red opertions, which chnge the knowledge of users, updte or write opertions, which chnge the stte of stored dt, nd uthoriztion opertions (like grnt or revoke) by which ctors cn grnt or revoke other ctors uthoriztions of opertions. If our frmework is cpble to express ll the constrints we wish to formlize, then it would be of gret help to hve n utomted resoning tool tht decides for set of constrints expressed in this frmework whether it is consistent or inconsistent. So, we re looking for frmework tht on the one hnd is expressive enough to encode ll the desired constrints nd on the other hnd is restricted enough to be decidble or t lest semi-decidble. 1.4 Our Approch In this work we develop logicl frmework tht is cpble to uniformly formlize semntic constrints nd security constrints of informtion systems. The frmework consists of computtionl model, logicl clculus the semntics of which is defined over the computtionl model nd tbleu bsed proof system. The computtionl model represents ech ctor nd ech object of n informtion system uniformly s gents. Ech gent cn perform opertions nd hs her own 12

13 1.4 Our Approch opertion lphbet. The dt stored in objects is represented by propositions locl to the respective gent. The fctul knowledge of n ctor is represented by propositions locl to the respective gent. We ssume tht ech gent works utonomously of other gents nd hs her own locl time line. Agents synchronize with other gents by jointly performing synchroniztion opertions. Ech gent hs locl view on the system nd locl stte. Two sttes of the system re equivlent for gent i if they do not differ in the locl stte of gent i, however, they cn differ in the locl stte of some gent j other thn i. This mens, if the system reches stte c from stte c through n opertion in which i hs not prticipted, the sttes c nd c re equivlent for i. To cpture n gent s knowledge in the model we define n indistinguishbility reltion for knowledge for ech gent i tht describes for ech stte c, which sttes re indistinguishble from c for gent i. Similrly, to cpture n gent s belief in the model, we define n indistinguishbility reltion for belief for ech gent i. Aprt from the computtionl model, our frmework contins temporl nd epistemic logic the semntics of which is defined on the described computtionl model. For ech gent, the lnguge provides locl next opertors lbelled by opertions, locl until opertor, locl belief nd locl knowledge opertor. The temporl prt of the logicl clculus is lightweight version of tht presented in [Nie97]. The key ide of the temporl prt of the logic is tht formule look t the configurtions from locl point of view of either single gent or of group of gents. The epistemic prt of the logicl clculus is closely relted to the work of Rmnujm presented in [Rm96]. We will discuss this in detil lter in chpter 2. The key ide of the epistemic prt of the logic is tht knowledge of gents chnges due to ctions: if n gent does not prticipte in n ction, her knowledge remins unffected nd lso, the enbling of n ction remins is independent of the knowledge of gents tht do not prticipte in the ction. The third component of our unifying frmework is sound nd complete tbleu bsed proof system for subset of this logic tht does not contin belief opertors. In the computtionl model, chnge of knowledge of n gent is only due to performnce of opertions by the gent. The enbling nd the effect of n opertion is dependent only on the knowledge of prticipting gents. This seems to be very nturl constrint. However, exctly this constrint mkes the tbleu system quite involved. Our tbleu system will explicitly represent the temporl reltions nd epistemic indistinguishbility reltions in the tbleu to hve kind of globl view on the whole system under construction. 13

14 Chpter 1 Introduction 1.5 Outline of the Thesis In chpter 2 we try to get n overview over the vrious pproches of modl logics vilble so fr for the specifiction of the vrious types of constrints nd discuss in detil the pproches relevnt for our frmework. In chpter 3 we describe our view of n informtion system. We define computtionl model nd show how this model represents our view of n informtion system. In chpter 4 we formlly define the syntx nd semntics of the specifiction lnguge nd investigte some properties of the lnguge. Chpters 5 nd 6 present the tbleu bsed proof system for the logic nd prove its soundness. The developed tbleu system is not complete if we consider the full logic. However, we show tht the tbleu system is complete for resonble subset of the defined logic. In chpter 7 we present detiled exmple in which we show, how the developed frmework cn be used to uniformly specify the vrious types of constrints in n informtion system. Finlly, in chpter 8 we discuss open problems which we did not investigte in this thesis. A prt of this work, nmely our view of n informtion system cptured in the computtionl model in chpter 3 nd the logicl lnguge defined in chpter 4 ws published s [BS03]. At some points in this work, we use text pssges from the mentioned publiction, if we find it pproprite nd do not see the need of reformultion. 14

15 Chpter 2 Relted Work In the pst lot of work concerning formliztion of dtbse constrints hs been done. In the logicl pproch to informtion systems, it is ssumed tht the system dministrtor expresses the semntic constrints in declrtive style t design time. He specifies formule in n ppropritely restricted forml lnguge of logic clculus. The logic clculus is presumed to hve syntx for formule nd model-theoretic semntics, i.e., there exists definition of formul is stisfied by some structure (or some interprettion) nd bsed on tht definition of set of formule implies nother formul. In the context of informtion system, instnces of n informtion system re considered s structures in the sense of the logic clculus. In policy oriented pproch to security, security dministrtor expresses the security constrints in declrtive style. He specifies some formule in n pproprite forml lnguge. It is ssumed tht besides syntx for formule, semntics is provided too, i.e. definition of formul is stisfied by history tht comprises, possibly mong others, sequence of ctul executions of opertions, nd bsed on tht, of set of formule implies nother formul. In this section we nlyze vrious pproches for the logicl formliztion of informtion systems found in the literture. While semnticl constrints hve been widely investigted, still lot of work is required with regrd to security constrints nd in prticulr with regrd to the combintion of both types. In the introduction we hve identified spects tht should be met by the frmework: The frmework should be suited to model sttes of the informtion system, its temporl behviour nd its epistemic behviour in distributed environment, in which vrious components ct utonomously nd concurrently. In most ppers only few spects of security constrints were investigted, other spects were fded out. 15

16 Chpter 2 Relted Work 2.1 Temporl Aspects in Distributed Informtion Systems Temporl logics hve been successfully used for modeling temporl integrity constrints in informtion systems (see e.g. [CT98]): Updtes nd integrity constrints cn be formulted in n bstrct, representtion-independent wy. Chomicki nd Tomn give n overview of the development of temporl logics in informtion systems. Informtion systems cn be seen s open, rective nd usully distributed systems tht dministrte persistent dt. Ech component (object, user, dministrtor, etc.) crries out opertions tht chnge the stte of the informtion system. It is especilly interesting for our im to look for temporl logics tht llow to model distributed behviour. A lot of work hs been done in the field of modeling temporl behviour in rective systems nd multi-gent systems (see for exmple [MP92], [Lm94], [LPRT93], [Wei99], [HS98], [Woo00]). In the field of multi-gent systems very common pproch re BDI-models (beliefdesire-intention-models), [Wei99], [HS98], [Woo00]. Agents re seen s entities tht re cpble of observing their environment nd of resoning bout it nd of independently nd utonomously performing ctions bsed upon decisions mde by these gents dependent on their observtions of the environment. In this perspective, ech gent is ssumed to hve its own belief, desires nd intentions. In [Woo00], Wooldridge introduces very powerful first-order BDI-logic clled LORA (Logic for Resoning Agents). LORA consists of severl components: first-order component, belief/desire/intention component nd temporl component. The temporl component is bsed on CTL, well known temporl logic with n interleving semntics. Rective systems cn be seen bit wider thn multi-gent-systems. In rective systems, not ll components necessrily need to be gents in the sense described bove. A very common model for rective systems re so-clled Mzurkiewicz trces, refer [Mz95], [MOP89]. Mzurkiewicz trces re semntic concept for modeling concurrency. Unlike other semntic concepts, e.g. Kripke structures, the min chrcteristic of such trce systems is to explicitly differentite between concurrency nd nondeterministic choice. Another min feture of trce systems is the bstrction of interleving; modeling of true concurrency is possible. In trnsition system, b ( prllel b) is modeled sme s, b b, (nondeterministic choice between followed by b nd b followed by ). A trce system on the other hnd differentites between these two opertions. Although this model is not more expressive thn semntic concepts with interleving, it cn void the known (notorious) stte explosion problem. Temporl logics for distributed systems bsed on Mzurkiewicz-trce systems hve 16

17 2.2 Epistemic Aspects in Distributed Systems been developed by Penczek, Thigrjn, Lody, Rmnujm, Niebert nd others [Thi94, Pen93, Nie97]. Thigrjn develops TPTL (Trce bsed Propositionl Temporl Logic) in [Thi93] to express nonsequentil behviour directly without using interleving. Nonsequentil behviour occurs in rective systems with multiple utonomous sequentil gents. A more expressive logic ws introduced by Niebert in [Nie95, Nie97]. In ddition to the usul logicl connectors, TPTL contins locl next nd until, similr to the ones known from PTL (for detiled description see [Thi93]). νtrptl contins fixpoint opertors insted of until, thus νtrptl is strongly more expressive thn TPTL. TPTL s well s νtrptl bse upon trces seen s nonsequentil runs of distributed system. Such system consists of n rbitrry but fixed number k of sequentil gents which synchronize by performing ctions jointly. Ech gent i is ssigned non-empty locl lphbet Σ i of ctions, Σ = (Σ 1, Σ 2,..., Σ k ), (k = number of gents of the system) is clled distributed lphbet. Agent i must tke prt in ech ction Σ i. Thus synchroniztion between individul gents is modeled by the joint execution of ctions. If two ctions nd b re not contined in the sme lphbet, they cn be executed independently. Infinite trces cn be seen s Σ-lbelled prtil orders (fulfilling certin chrcteristics), where Σ = i {1,...,k} Σ i. [Thi93, NS97] prove the decidbility of the stisfibility problem for TPTL s well s for νtrptl. Inspired by this development of logics for distributed systems, Ehrich, Cleiro, Sernds nd Denker presented in [ECSD98] two object-oriented logics cpble of expressing communiction mong objects. In these logics, ll objects of dtbse system re seen s sequentil gents nd re thus components of the distributed system. 2.2 Epistemic Aspects in Distributed Systems There re severl pproches in which dtbse is seen s collection of knowledge (see e.g. [Rei90] or [CD96, CD97]). If we follow this view, we cn uniformly see dtbse objects, users, dministrtors etc. s resoning gents in distributed environment. Over the lst decde, modelling of knowledge hs been field of gret reserch interest, especilly for multi-gent systems. [FHMV95] gives n excellent overview of the stte of the rt in this topic. Trditionlly, modl logics of knowledge re interpreted over globl sttes of the distributed system. As motivted in the introduction, we cnnot ssume such globl stte: Every gent only hs locl view on the system nd when the system chnges due to n ction by group of gents, only gents of the cting group 17

18 Chpter 2 Relted Work typiclly know the effect of tht ction. The knowledge of the non-prticipting gents remins unchnged, nd this fct is known by ll gents. Rmnujm nlyses in [Rm96, Rm94, Rm99] the mening of knowledge in distributed systems. A similr discussion crried out by Vn der Hoek nd Meyer in [vdhm92] ddresses the following questions: 1. Wht exctly is knowledge stte? 2. Is the knowledge tht is logiclly implied by the vilble informtion ctully computble? 3. Given knowledge stte, cn we decide, which other sttes re rechble? 4. Cn the ctions of one gent hve influence on the knowledge of nother? Rmnujm develops n ction bsed temporl nd epistemic logic ([Rm94]), in which knowledge chnges cused by ctions of gents cn be expressed. This logic is nturl extension of PDL (Propositionl Dynmic Logic) with ctions enriched with the modl opertor K s it is defined by Hintikk in the logic S Deontic Aspects We considered different types of constrints in the introduction. Security constrints in dtbse system lwys del with obligtions nd uthoriztions. The tendency to formlize such constrints through deontic logic hs been minly followed by Cuppens, Demolombe, Crmo nd Jones. In this method, dtbse is considered s normtive system nd the corresponding security nd semntic constrints re seen s deontic constrints: It ought to be, tht..., It is necessry, tht..., It is permitted, tht... The mening of normtive system in this context is, tht set of gents (softwre systems, humns etc.) interct ccording to some rules. It is not explicitly mentioned, tht the misconduct of the gents is impossible. Normtive systems rther suggest, how to hndle the misconduct of n gent. In these pproches, it is often distinguished between hrd nd soft deontic constrints (see [CJ94]). Hrd deontic constrints re constrints, tht my never be violted, such s Every member of the deprtment possesses n identifiction number. Soft deontic constrints, e.g. Books cn only be issued to the members of the deprtment, must eventully be fulfilled, however, they might be violted for certin period of time. Similr to this view is the distinction between idel, sub-idel nd prohibited sttes of such system. This method of clssifiction of sttes ws first introduced by [JP85]. Idel sttes in dtbses re those situtions, in which ll 18

19 2.4 Combintion of Deontic nd Epistemic Aspects constrints re fulfilled. In sub-idel sttes, some wek constrints my be violted, but the system must still be trnsformble in n idel stte, i.e. eventully fulfill ll constrints. Prohibited sttes correspond to situtions which re not llowed to occur. Logics suggested in this context (e.g. in [CJ94]) minly focus on the deontic spects. Temporl fetures s we would need them for our frmework re only very bsic (minly simple trnsitions between sttes), strong temporl components like until or eventully to cpture lrger periods of time re not provided. In our view, uthoriztions for performing opertions cn be modeled by ssigning prticulr rights to the components of the informtion system. Then we cn formlize temporl constrint, tht roughly expresses the following: All opertions tht re not explicitly llowed for component, cnnot hppen. We could lso formlize dul temporl constrint: All opertions tht re not explicitly forbidden, my eventully hppen. These rights re not sttic in the system but my be chnged by other components. The distinction between soft deontic constrints (those, tht must eventully be fulfilled) nd hrd deontic constrints (those, tht must lwys be fulfilled) cn lso be done in temporl wy: Hrd deontic constrints lwys hve to be fulfilled, wheres soft deontic constrints my be violted t some sttes but must eventully be fulfilled. As consequence, in our pproch deontic spects re completely reduced to temporl spects nd the dded feture of explicit rights, or explicit forbiddnces, respectively. Dignum et l hve somewht different interprettion of deontic spects in [DMWK96]. This pper dels with the question, which obligtions for individul users of dtbse systems re born from the corresponding pst of ech user. The logic developed in this pper consists of temporl opertors (directed into pst) nd deontic opertors, dynmic (ought-to-do), s well s sttic (ought-to-be). Further, the logic contins one more modl opertor, which formlizes the intention of the corresponding gent. This opertor cn be seen s kind of Next-opertor, which only llows ctions, which re idel in sense of intended ctions, s next ctions. 2.4 Combintion of Deontic nd Epistemic Aspects We look bck to the epistemic spects of security constrints. There re lot of works, minly by Reiter [Rei90], Cuppens nd Demolombe [CD96, CD97], but lso by McEwen [GMP92, MCK96] in which dtbse is seen s collection of knowledge: the dtbse knows or believes in set of fcts bout the rel world, users of the dtbse get to know the prts of these fcts by querying the dtbse. In 19

20 Chpter 2 Relted Work ssocition with inference control, the question rises, which knowledge is llowed to be ccumulted by user? Wht is he unuthorized to know? In ([CD97]), Cuppens nd Demolombe define modl logic with epistemic nd deontic opertors nd bsed on Kripke structures. They show, tht this logic is xiomtisble. It cn be expressed in this logic, which contents of dtbse user knows (KB i ), or my know (PKB i ) s well s which contents user in prticulr role my or my not know (PKB r, FKB r ). The knowledge, the prohibitions or permissions to know re lwys relted to the fcts in the dtbse. Knowledge bout the knowledge of other users or the knowledge bout the ctions performed in the dtbse is however not formultble. Chnges in the dtbse, which led to chnges of knowledge of the users, were lso disregrded. It is ssumed, tht the contents of the dtbse re fixed. In our context we must ssume, tht users cn gin knowledge not only bout the dt stored in the informtion system but lso bout the behviour of the system itself s well s of the knowledge (or belief) of other users. 20

21 Chpter 3 Our View of n Informtion System In this chpter, we cpture our view of n informtion system in computtionl model for the temporl nd epistemic logic defined in the next section. The model consists of three spects: sttic spects, dynmic spects concerning control nd dynmic spects concerning knowledge nd belief. In the first two spects we roughly follow the definitions in [Nie97] of prtil order model for rective system. We then extend the model by n epistemic component. The epistemic definitions re more or less stndrd: Situtions (worlds) re relted by indistinguishbility reltions. To cpture interction between knowledge nd time, we define the indistinguishbility reltions dependent of the temporl definitions. 3.1 Sttic Aspects We view distributed informtion system s consisting of severl components, e.g. dt objects, users, dministrtors, nd security mngers. If the informtion system is viewed s piece of softwre, then dt objects lie inside the system wheres users, dministrtors, etc. pper outside the system. If we provide representtive user-gent inside the system for ech outside ctor, nd repository-gent for ech dt object, then we cn model ll the components of n informtion system uniformly s sequentil gents. We cll the finite set of ll k gents of n informtion system Ag. Tht is, Ag := {1,..., k}. The current stte of ech object, i.e. its dt content, is represented by set of propositions locl to the corresponding repository-gents. Similrly, the current stte of user, i.e. wht dt she hs red or which rights hve been grnted to her, is represented by set of propositions locl to the corresponding user-gent. Ech gent i of our system is thus ssocited with finite set of locl propositions P i. Let P := (P 1,..., P k ) 21

22 Chpter 3 Our View of n Informtion System be the distributed set of propositions, such tht P i P j = for i j. Further, we denote with P = i Ag P i the set of ll propositions. All gents cn perform opertions (red, insert, delete, grnt rights, revoke rights, etc.) prtly utonomously, prtly together with other gents s joint opertions. Seen s whole system, ll these components work concurrently: E.g. while ctor 1 inserts some vlue x in object o, nother ctor 2 could t the sme time (concurrently) grnt some execute right r to third ctor 3. However, ech single component performs its opertions sequentilly. Thus, we equip ech gent i with her own finite, non-empty opertion lphbet O i. Let Õ = (O 1,..., O k ) be distributed set of opertions, nd O = i Ag O i. With g(op) := {i Ag op O i } we refer to the set of gents which re involved in the execution of joint opertion op. An opertion op O i O j is clled synchroniztion opertion between gents i nd j. Two opertions op 1 nd op 2 re clled independent iff g(op 1 ) g(op 2 ) =. The informl mening of these opertions will be represented by the chnges of the interprettion (see definition below) of locl propositions. Summrizing the discussion bove, we see the sttic declrtions of distributed informtion system s concurrent system of sequentil gents, where ech gent is equipped with set of opertions nd set of locl propositions. Definition (sttic declrtions of n informtion system) Let the sttic declrtions of n informtion system be defined s tuple (Ag, Õ, P), consisting of set of gents, their distributed set of opertions nd their distributed set of locl propositions. 3.2 Dynmic Aspects Concerning Control Given the sttic declrtions of n informtion system, we now describe the control flow of its possible dynmic behviours. Below, this control flow is formlized s runs. Ech occurrence of n opertion within behviour is denoted by n event. Thus possible behviour is cptured by set of events which should stisfy some requirements in order to represent resonble control flow. It should be finite or t most denumerbly infinite. 22

23 3.2 Dynmic Aspects Concerning Control It should be prtilly ordered ccording to the reltive occurrence of events in time. It should distinguish some specific events s the explicit beginning of behviour. More precisely, ech single event should hve only finite set of predecessors ccording to the prtil order. At ech event, exctly one opertion occurs. For ech gent i, the set of events this gent is involved in is even totlly ordered ccording to the reltive sequence in time. Every occurrence of n opertion in the control flow of possible behviour of n informtion system is n event. The set of ll events of run is prtilly ordered. And since we hve n explicit beginning of the run of such n informtion system, the downwrd closure of ech subset of the set of events of run is finite. Definition (downwrd closure) Let E be set nd E E be prtil order on E. For M E, M := {e E e M : e e } denotes the downwrd closure of M. For e E we write e insted of {e }. Now we cn formlly define the control flow of possible behviour of n informtion system s run. Definition (run) A run F (Ag,Õ, P) = (E,, λ) of n informtion system with the sttic declrtions (Ag, Õ, P) is prtilly ordered, lbelled set of events E, s.t. the following holds: E is finite or denumerbly infinite. is prtil order on E. For ll e E the downwrd closure e is finite. λ : E O is lbelling function yielding the opertion λ(e) occurred t event e. For ll i Ag, the reduction of on E i := {e E λ(e) O i }, i.e. (E i E i ), is totl order. 23

24 Chpter 3 Our View of n Informtion System We define F (Ag, Õ, P) s the set of ll possible runs F (Ag,Õ, P) over the sme sttic declrtions (Ag, Õ, P). We write F insted of F (Ag,Õ, P) nd F insted of F (Ag,Õ, P) where this does not led to misunderstndings. (F, c 0 ) (F, c 1 ) (F, c 2 ) (F, c 3 )(F, c 4 ) Ag 1 e 1 e 12 e 13 Ag 2 e 2 Ag 3 e 3 Exmples of configurtions: c 0 =, c 1 = {e 3 }, c 2 = {e 1, e 3 }, c 3 = {e 1, e 3, e 12 }, c 4 = {e 1, e 3, e 12, e 2 } Ag 3 s view of configurtion c 4 : g 3 c 4 = c 1 = {e 3 } c 1 Ag3 c 2 Ag3 c 3 Ag3 c 4 Figure 3.1: Exmple of run nd locl configurtions See figure 3.1 for n illustrtion of possible run: The exmple run is executed by three gents Ag 1, Ag 2 nd Ag 3. Ech gent is represented by her own (horizontl) time line. The gents perform opertions sequentilly: Ag 1 performs the sequence of opertions op 1, op 12, op 13. Agent Ag 2 performs the sequence of opertions op 12, op 2. And gent Ag 3 performs the sequence of opertions op 3, op 13. Ech event, i.e. occurrence of n opertion, is represented by verticl br with circles for the prticipting gents. Though the events for ech gent re totlly ordered, the set of ll events of the system re only prtilly ordered: for exmple, opertions op 1 nd op 3 re performed concurrently, no order is given between them. A configurtion c of run F is downwrd closed set of events, it contins ll events tht re performed by gents up to prticulr point in time. Ech gent only hs locl view on the system. The locl view on configurtion c of run F for n gent i is itself configurtion nd consists of the downwrd closure of ll events tht 24

25 3.2 Dynmic Aspects Concerning Control gent i hs performed in configurtion c. It is thus the lest configurtion which coincides with c on ll i-events. Formlly, we define configurtion s follows: Definition ((locl) configurtion; i-view) Let F = (E,, λ) be run. A configurtion c of F is finite, downwrd closed set of events (i.e. c E nd c = c). Let C F denote the set of ll configurtions of run F. The locliztion of configurtion i c := (c E i ) is clled the i-view of configurtion c, i.e. the i-view is the lest configurtion tht coincides with c on ll i-events. Two configurtions c, c of F re sid to be i-equivlent (c i c ), iff i c = i c. They re sid to be A-equivlent (c A c ), iff they re i-equivlent for ech i A. On configurtions of F we define successor reltion so tht c op c iff c = c {e} for some e E with λ(e) = op. Two configurtions of the sme run tht differ from ech other only through events in which gent i does not prticipte re equivlent from the point of view of gent i. We cll such configurtions i-equivlent. If configurtions c becomes configurtion d by execution of n opertion op nd configurtion c becomes configurtion d by execution of n opertion op, nd if c i c for t lest one i g(op), then opertion op is synchroniztion opertion for ll gents j g(op) nd thus, the resulting configurtions d nd d re j-equivlent (d j d ) for ll j g(op). Lemm Let c, c, d, d C F be configurtions of the sme run F, nd let op be n opertion. It holds tht if c i c for ny i g(op) nd c op d nd c op d then d j d for ll gents j g(op). Proof: Let F be run nd let c, c, d, d C F be configurtions of this run. Let op be n opertion. c i c for ny gent i g(op) nd c op d nd c op d. 25

26 Chpter 3 Our View of n Informtion System c i c for ny gent i g(op) nd c op d nd c op d. = (c E i ) = (c E i ) nd there exist events e, e E with c {e} = d with λ(e) = op nd c {e } = d with λ(e ) = op = (* by definition item (5) *) (c E i ) = (c E i ) nd there exists n event e E i with c {e} = d nd c {e} = d with λ(e) = op = (* by definition d nd d re downwrd closed *) c j c for ll j g(op) = (* e E j for ll j Ag *) d j d for ll gents j g(op) Consider gin figure 3.1. A configurtion is indicted by (more or less verticl) line tht crosses ech gent s time line t box. The configurtion contins ll events to the left of the line. The initil configurtion c 0 = contins no events. In the figure it is denoted by dshed line. The configurtions c 1, c 2, c 3 nd c 4 re equivlent from gent Ag 3 s point of view, which is illustrted by the solid lines through gent Ag 3 s second box. In ech of these configurtions, gent Ag 3 hs performed only event e 3, the configurtions differ only in events performed by other gents. Configurtion c 1 represents the view of gent Ag 3 on ll the configurtions c 1, c 2, c 3 nd c 4. Sometimes, we need to tlk bout configurtions of different runs. To mke sure, which configurtion of which run we men, we hve to nme both the configurtion nd the run to which it belongs. Definition (sitution) We cll (F, c) sitution, when F = (E,, λ) is run nd c C F is configurtion of this run. On situtions we define successor reltion so tht (F, c) op (F, c ) iff c op c for c, c C F. We define i (F, c) s the locliztion of sitution (F, c) iff i (F, c) = (F, c ) nd c = i c. Two situtions (F, c) nd (F, c ) re clled i-equivlent ((F, c) i (F, c )) iff c i c. For set of runs A we define A := {(F, c) F A, c C F } to be the set of ll situtions of ll runs in A. Note, tht our definition of sitution minly describes progress in time nd leves propositions still uninterpreted. 26

27 3.3 Dynmic Aspects Concerning Knowledge nd Belief 3.3 Dynmic Aspects Concerning Knowledge nd Belief In order to cpture the gent s knowledge nd belief, we need more generl notion of indistinguishbility thn is defined bove. An gent does not know the ctul current configurtion of the ctul run of the system. At ll times, n gent i only sees prtil system, e.g. it cn notice the behviour of other gents only vi synchroniztion opertions, other opertions of other gents re independent of nd invisible for gent i. Aprt from tht, the gent is not even wre of the ctul run, she for exmple cnnot distinguish between the ctul configurtion of the ctul run nd configurtion of different run, in which she hs cquired the sme knowledge. Though we ssume tht n gent knows, which opertions other gents my in principle perform, i.e. though the gent is wre bout other gents opertion lphbet, she does not know which opertions the other gents ctully perform. Further, we do not require tht the gents hve perfect recll, which mens, we do not ssume tht ech gent lwys remembers ll the opertions she hs lredy performed nd lwys remembers ll the knowledge, she hs lredy cquired. We llow tht n gent i considers two situtions s indistinguishble, though they hve different history locl to gent i. The gent does not necessrily remember the wy how she cquired some knowledge, she only knows, tht she hs cquired the knowledge. As lredy indicted bove, since ech gent only hs prtil view on the whole system, she does not know ll fcts tht re true. As in the epistemic logic S5 we require, however, tht if n gent knows fct, then this fct must be true. This property is often clled the Knowledge Axiom or the Truth Axiom. Further, s in the epistemic logic S5 we require tht gents cn do introspection regrding their knowledge. An gent should know, wht she knows (this is typiclly clled Positive Introspection) nd she should know, wht she does not know (typiclly clled Negtive Introspection). Lter, in chpter 4.2 we define tht n gent knows fct if this fct is true in ll situtions indistinguishble for this gent. (In terms of stndrd modl logics such situtions re clled indistinguishble, the corresponding reltion is clled indistinguishbility reltion.) We now define n indistinguishbility reltion R k i for knowledge for ech gent i Ag. In the definition of the indistinguishbility reltion we follow the stndrd pproch of the modl logic S5 (KT45). As for exmple shown in [FHMV95], ech of the bove requirements is directly reflected by properties of the indistinguishbility reltion: Reflexivity of the indistinguishbility reltion reflects the truth xiom, trnsitivity of the indistinguishbility reltion reflects the positive introspection xiom nd the Eucliden property reflects the negtive introspection xiom. Hence, 27