Security level evaluation: Policy and fuzzy techniques

In a world made of interconnected systems that manage huge amount of confidential and shared data, security plays a significant role. Policies are the means by which security rules are defined and enforced. The ability of evaluating policies is becoming more and more relevant, especially when referred to cooperation of services belonging to un-trusted domains. In this paper we have focused our attention on Public Key Infrastructures (PKIs); at the state of the art security policies evaluation is expressed by means of security levels. However, policy evaluation must face uncertainty deriving from different perspectives, verbal judgments and lack of information. Fuzzy techniques and uncertainty reasoning can provide a meaningful way of dealing with these issues. We illustrate a fuzzy technique to evaluate the security level for a given policy against a set of reference policy levels.