An expressive model for the specification and analysis of obligations

The notion of obligation is used in a variety of domains, ranging from legal frameworks to cybersecurity (e.g. in access control policies, to specify privacy guarantees in web services and mobile applications, to deal with data collection constraints in the Internet of Things). We define an axiomatic model of obligations as an extension of the category-based access control (CBAC) metamodel. An abstract notion of event is used to identify system states that trigger obligations or fulfill them. The category-based model of obligations inherits the generality of the CBAC metamodel, allowing us to specify obligations in all of the above-mentioned domains. Obligations can be defined on their own or linked to data collection or access control decisions. In the latter case, the access control policy should be compatible with the obligation policy to ensure that obligations can be fulfilled. We provide techniques to analyse the interplay between obligations and authorizations in order to ensure compatibility.