An automated policy refinement process supported by expert knowledge

English) In a policy-based system management, a policy refinement process is requiredto translate abstract policies, which are specified by human, into enforceablepolicies, which are enforced by machine.However, a manual policy refinement process imposes some problems.The first problem is that it requires expert knowledge to perform the policyrefinement process. The second problem is that refining policies for com-plex systems is a tedious task. Manual refinement process may cause somenegative consequences due to human errors, i.e., improper specification ofenforceable policies.In order to solve the problems mentioned above, we envisage the auto-mated policy refinement process by using refinement patterns. By adoptingthe pattern paradigm, we define the refinement patterns to capture the ex-pert knowledge. Furthermore, we formalize these refinement patterns, thepolicies and the considered system. This approach enables the automationof the policy refinement process, which solves the second problem.We present these building blocks: (i) formal representations of the con-sidered system and the policies, (ii) definition of a policy refinement tree, (iii)definition of policy refinement patterns in formal representation, (iv) com-bining computational tree logic-* and description logics formalisms to enablethe automated pattern matching and (v) development of the algorithm forpolicy refinement and for generating the enforceable policies.In this thesis we consider the refinement of workflow policies as our sce-nario, since we want to specify access control policies. These access con-trol policies are derived from workflow. These policies are usually specifiedin domain-specific terminologies, such as finance, engineering, military, etc.Thus, it underpins our approach to using semantic technology to formalizethe policy refinement patterns. Although the work presented in this thesisdeals with the refinement of workflow policies, one can adapt this approachto refine policies for various discrete systems.The contribution of this thesis is a concept to automate the policy refine-ment process by using security experts knowledge, which is stored as policy