Information Sharing Policies. We use four types of information sharing policies in the information sharing protocol. They are information release (IR) policies, credential release (CR) policies, trust level adjustment (TLA) policies, and access control (AC) policies. To illustrate the four types of policies, we need to first introduce a set of notations. In our protocol, we assume there are two agencies: A and B. We assume Ca1, …, Cam are the m credentials held by agency A; and Cb1, …, Cbn are the n credentials held by agency B. We assume Ua1, …, Uau are the u units of information owned by A; and Ub1, …, Ubv are the v units of information owned by B. We assume TL(A) is the trust level of A in the eyes of agency B, which indicates the degree to which B trusts A; and TL(B) is the trust level of B maintained by A. We assume the trust levels are quantified using an integer from 1 to 10, the simplest way. Although trust levels can be quantified in a more complicated way, numerical trust levels are enough to show the idea of our information sharing protocol. Finally, we assume utitlity(Uai) measures the utility level of information unit Uai to agency A, which indicates the degree to which Uai is useful to A. We assume utilities are quantified using an integer from 1 to 7. Now we define the four types of information sharing policies one by one following an order that can best illustrate the relationships among these policies. An information release policy is used to help agency A to determine when a specific information unit can be disclosed to agency B. An IR policy is simply a set of component policies. An example IR component policy is shown in Figure 4, where we can see that an IR component policy is composed of two parts: the condition part is a conjunction or disjunction of a set of predicates, and the action part specifies the information unit that can be released when the condition is satisfied?” The condition of an IR component policy can consist of 0 to 4 predicates. When there are 0 predicates, there is no restriction to disclose the information unit. When there are 4 predicates, as Figure 4 shows, when agency A wants to determine whether to disclose an information unit to agency B, the first predicate is to check if B is “authorized” to access the information unit. How such checking should be done is specified by an access control policy which we will define shortly. Condition: access-control-passed({Cb1, …, Cbp}, Uaj) AND received-and-valid(Ub1, …, Ubq) AND utility(Ub1, …, Ubq) >...
