Goal-Based Explainable Security Certificate Requests

Abstract

In crisis situations it is important that crisis response workers can quickly get access to the right information for the tasks they are required to undertake. A distinction can be made between getting the right information and having the rights to get that information. The first is an information filtering and relevance problem, the second is a security issue related to access control. In this paper we focus on the second issue. It is impossible to predefine access rules for all players in a crisis situation that ensure that they have access only to the information they need. Therefore the key is to have a system that is flexible and timely (efficient) with respect to the decision to grant access, without a major burden on humans having to make these decisions, and without inadvertant leakages of sensitive information. We believe for crisis management it is more important to be able to hold individuals and organizations accountable for their use of information than to overly restrict access to information. We propose goal-based explainable security certificate requests as a solution to this problem.