A deontic logic for reasoning about confidentiality

Abstract

This paper presents a deontic logic Σ for reasoning about permission or prohibition to know some parts of the databjase content in the context of a multilevel confidentiality policy.

The most important logical features in the definition of a multilevel policy are that each confidentiality level is defined by a set of sentences and that, when the policy is designed, the permission to know is not necessarily the complement of the prohibition to know. These concepts are formalized in a modal logic where deontic modalities, doxastic modalities and confidentiality levels are interpreted by non-standard modal models. The corresponding axiomatics is also presented in the paper and its soundness and completeness have been proved. A limitation of the Σ logic is that sentences in the scope of modalities are sentences of Propositional Calculus.

Finally, it is shown how the logic can be used to express constraints to guarantee the consistency of a policy or to prevent the existence of inference channels. That is, the possibility to infer sentences that are not permitted to know from other sentences that are permited to know. Both deductive and abductive channels are considered.