Context-based security management for multi-agent systems

Policies are being increasingly used for controlling the behavior of complex multi-agent systems. The use of policies allows administrators to specify both agent permissions and duties without changing source code or requiring the consent or cooperation of the agents being governed. However, policy-based control can encounter difficulties when applied to agents that act in pervasive environments characterized by frequent and unpredictable changes. In this case, policies cannot be all specified a priori to face any operative run time situation, but require continuous adjustments to allow agents to behave in a contextually appropriate manner. Current approaches to policy representation have been restrictive in many ways, as they typically follow a subject-centric model, which assigns agent permissions and obligations on the basis of agent role/identity information. However, in the new pervasive scenario the roles/identities of interacting agents may not be known a-priori and most important, may not be informative or sufficiently trustworthy. We claim that the design of policy-based agent systems for pervasive environments requires a paradigm shift from subject-centric to context-centric policy models. This paper discusses some issues concerning the specification and enforcement of context-driven policies and presents a novel context-based policy approach that considers context as a first-class principle to guide both policy specification and enforcement. In this perspective, "context" explicitly appears in the specification of security policies and context changes trigger the evaluation process of applicable agent permissions and obligations.