�ݺ�ߣ

University of Insubria
Department of Theoretical and Applied Science

Policies for Composed Emergencies in
Support of Disaster Management
Barbara Carminati, Elena Ferrari, Michele Guglielmi

European Office of Aerospace Research & Development

Emergency Management

Hurricane Katrina 9/11 Attack Fukushima

Information Sharing

Traditional vs Emergency Access Control

Traditional access control models are regulated by a proper
set of pre-defined access control policies.
An Emergency access control model should (during an
emergency) bypass the regular access control policies and
grant users access to resources not normally authorized.

Downgrading of information security

Temporary Controlled Timely

B. Carminati, E. Ferrari, and M. Guglielmi, Secure information sharing on support
of emergency management. In proceeding of The Third IEEE International
Conference on Information Privacy, Security, Risk and Trust (PASSAT).

Emergency Access Control Model

Temporary
Emergency Emergency
access control
Detection Obligations
policies

Complex Event Emergency Policy
Processing (CEP)

Access Control Model
Emergency Temporary Access
Descriptions Control Policies
(init, end, timeout, priority) (sbj, obj, priv, obl)
Explosion { SteamFilesPol {
init: PS1 p1
PS1 = σ(pressure > 100)(PipeSensors);
sbj: EPA Agents
end: PS2 p2 obj: SteamFiles
PS2 = σ(pressure ≤ 100)(PipeSensors); priv: read
timeout: ∞; obl: null
priority: high; }
}

Emergency Policy
(emg, tacp, obl)
ExplosionPol {
emg: Explosion
tacp: SteamFilesPol
obl: FacilityEvacuation
}

Composed Emergency
There exist critical scenarios that cannot be handled by
emergency policies:
combination of different emergency situations that may give
rise to a new and more critical emergency
Composed Emergencies
requiring a response plan different from those plans already
in place for the atomic emergencies
Composed Emergency Policies
Sometimes it is necessary to override the tacps and obligations that have
been activated as response plans of sub-emergencies with the tacps/
obligations of the composed Emergency

Overriding Strategies

Reference Scenario
Industrial Company Facility Scenario
Fire Alarm Explosion Toxic Material Loss

obl: obl: Facility obl: Warn EPA
1. FireFightersCall Evacuation
2. PoliceCall
MapsFilesPol { SteamFilesPol { ChemicalFilesPol {
sbj:FireFighters sbj:EPA Agents sbj:EPA Agents
obj: MapsFiles obj: SteamFiles obj: ChemicalFiles
priv: read priv: read priv: read
} } }

Reference Scenario

FireAlarm Explosion ToxicMaterialLoss

Ecological Disaster
obl: Warn DHS
AllFilesPol {
sbj:DHS Agents
obj: AllFiles
priv: read
}

Composed Emergency
A composed emergency ce is a pair
(combination, pr), where pr ∈ {high,low} indicates
the priority of the composed emergency, whereas
combination:
multiple occurrence
Pattern
a sequence
a negation

EcologicalDisaster = (Pattern,high)

FireAlarm,
Pattern = Explosion[FireAlarm,1h],
ToxicMaterialLoss[Explosion,3h]

Emergency Policy

An emergency policy is a tuple:
(emg, tacps, obligations, overriding) where:
emg: is an atomic or composed emergency
tacps: is a set of pairs (tacp, exception)
obligations: is a set of pairs (obl, exception)
overriding: consist of (tacpOver, oblOver), whose
values in {maintain, delete, block} denote the
overriding strategies for tacps/
obligations, respectively.

exception ∈{true,false} denotes the exception value.

Emergency Policy
deleted
maintained
EcologicalDisasterEP
-emg = EcologicalDisaster
-tacps = (AllFilesPol, true)
-obligations = (warnDHS, true)
-overriding = (delete, delete)

-tacps = (FacilityMapsFilesPol, true) -tacps = (SteamFilesPol, true) -tacps = (ChemicalFilesPol, true)
-obligations = (FireFigthersCall, true), -obligations = (FacilityEvacuation, true) -obligations = (warnEPA, true)
(PoliceCall, false) -priority = high -priority = high
-priority = low
-

Composed Emergency
The introduction of policies for composed emergencies
brings new issues:

when a composed emergency is triggered, its sub-
emergencies have been already instantiated and their tacps
and obligations have been already activated

the time needed to instantiate the new emergency could be
large since for each of the already inserted tacps/obligations it
should be determined whether it has to be
maintained, deleted or blocked

Emergency Composition Tree

ECT Node
An Emergency Composition Tree node has the following
attributes:

tacps
obligations
prioity ∈{high,low}

tacpOver ∈{maintain, delete, block}
oblOver ∈{maintain, delete, block}

tacpToDelete
oblToDelete
tacpToBlock
oblToBlock

ECT Example
EcologicalDisaster
-priority = high
-tacpOver = delete
-oblOver = delete
-tacpToDelete = { }
-oblToDelete = { PoliceCall }

- (PoliceCall, false) -priority = high -priority = high
-priority = low -tacpOver = delete
-oblOver = block
-tacpToDelete = { WaterFilesPol }
-oblToBlock = { WaterMaintenanceCall }

WaterContamination AirContamination
-tacps = (WaterFilesPol, false) -tacps = (GasFilesPol, false)
-obligations = (WaterMaintenanceCall, false) -obligations = (GasMaintenanceCall, false)
-priority = low -priority = high

ECT Enforcement
For a policy associated with a composed emergency, the
enforcement consists of the following steps:
retrieval of the ECT node related to the emergency

reading of the tacps and obligations attributes

enforcement of the retrieved tacps/obligations

reading of the overriding lists

execution of the overriding operations

ECT Enforcement Example
EcologicalDisaster
-priority = high
-tacpOver = delete
-oblOver = delete
-tacpToDelete = { }
-oblToDelete = { PoliceCall }

- (PoliceCall, false) -priority = high -priority = high
-priority = low -tacpOver = delete
-oblOver = block
-tacpToDelete = { WaterFilesPol }
-oblToBlock = { WaterMaintenanceCall }

WaterContamination AirContamination
-tacps = (WaterFilesPol, false) -tacps = (GasFilesPol, false)
-obligations = (WaterMaintenanceCall, false) -obligations = (GasMaintenanceCall, false)
-priority = low -priority = high

Indexing Data Structure
The same emergency could be part of one or more composed
emergencies, therefore to avoid storage of redundant
information we make use of an

indexing data structure

The position is encoded as index[emg] = (tj,lm,cn) where
tj denotes an ECT
lm and cn denote the position of the node related to emg in tj
(i.e., its level lm and relative position cn in the level, from left to
right).

Indexing Data Structure

Suppose to have the following ECTs:

nce1 nce4
nce2 nce3 nce5 nce6 nce2
index[ce1] = (nce1,0,0) index[ce4] = (nce4,0,0)
index[ce2] = (nce1,1,0) (nce4,1,2) index[ce5] = (nce4,1,0)
index[ce3] = (nce1,1,1) index[ce6] = (nce4,1,1)

ECT Generation
In order to generate all ECTs associated with composed
emergencies, we have defined an algorithm:

It receives as input the policy base containing policies for
composed emergencies and returns the set of created ECTs and
the associated indexing structure.

m = the number of composed emergency
max(n) = the maximum number of sub-emergencies involved at any level in a composed emergency
max(nt) = the maximum number of tacps associated with policies of all sub-emergencies
max(no) = the maximum number of obligations associated with policies of all sub-emergencies

Enforcement Analysis
Thanks to ECTs and indexing data structure composed
emergency enforcement is efficent
retrieval of the ECT node related to the emergency

reading of the tacps and obligations attributes

enforcement of the retrieved tacps/obligations

reading of the overriding lists

execution of the overriding operations

Prototype
Extend the prototype with the support for composed emergencies

Web Application

Emergency User
Manager
php

Web Server

Access Control
Emergency Repository
Handler

StreamBase
Server

Conclusions

Composed Emergency & Emergency Policies

A suitable data structure for an efficient enforcement

Future Work
Investigate more complex combination patterns.

Incremental maintenance strategies of the ECT data structure

Complement our system with new cloud computing techniques

�ݺ�ߣ

Policies for Composed Emergencies in Support of Disaster Management

Recommended

More Related Content

Featured (20)

Policies for Composed Emergencies in Support of Disaster Management