We live in the information age, a time when data and knowledge is plentiful and easily moved, processed and mined by machines. This makes it easier to discover knowledge and more efficiently manage our affairs but also increases concerns about information confidentiality, privacy and trust. Balancing these will be a defining challenge in the coming decades and is particularly urgent today in organizations responsible for national defense, law enforcement, emergency services, and public health and safety. The 9/11 Commission addressed this in their report and called for "a paradigm change from Need to Know to Need to Share". This project will explore one concrete aspect of this shift -- how executable policies can help organizations enhance their ability to share information and access while still maintaining appropriate levels of security, confidentiality and privacy.
The University of Maryland, Baltimore County, the University of Texas at San Antonio and the University of Texas at Dallas will build on existing work at our three institutions to develop and refine a a conceptual framework for computational policies to support information sharing in a need to share environment. Our framework will integrate and extend our work on access control (RBAC), usage control (UCON) and deontic policies (REI), grounding them in ontologies expressed in the Semantic Web language OWL. We will use it to design a policy specification language and enumerate required software artifacts and tools. Finally, we will study the framework applicability to realistic applications such as the management of healthcare records and homeland security related data.
