R. /. Aerospatiale and . Prole, Abecassis De plus en plus malmené, le secret médical est-il en danger ?, BIBLIOGRAPHIQUES Objectif Soins, issue.31, pp.22-23, 1995.

]. C. Alchourròn, Philosophical Foundations of Deontic Logic and the Logic of Defeasible Conditionals " , in Deontic Logic in Computer Science, pp.43-84, 1993.

]. R. Anderson, A Security Policy Model for Clinical Information Systems [Aristote 1992] Aristote, Organon -Les premiers analytiques, IEEE Symposium on Security and Privacy Bibliothèque des textes philosophiques, pp.30-43, 1992.

B. Beckert, J. Posegga, C. Beeri, S. Naqvi, R. Ramakrishnan et al., leanTAP: Lean tableau-based deduction, Sets and Negation in a Logic Database Language (LDL1) 6th annual ACM symposium on Principles of Database Systems (PODS), pp.339-358, 1987.
DOI : 10.1007/BF00881804

URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.28.5925

. Beeri, Secure Computer Systems: Unified Exposition and Multics Interpretation, The MITRE Corporation, ESD-TR-73-306 Valuation of Trust in Open Networks Integrity Considerations for Secure Computer Systems, MITRE Corporation Methods and Calculi for Deduction A Logical View of Secure Dependencies Expression of Confidentiality Policies with Deontic Logic The Chinese Wall Security Policy, Set Constructors in a Logic Database Language Journal of Logic Programming Third European Symposium on Research in Computer Security (ESORICS 94), (D. Gollman Brighton, United Kingdom, Lecture Notes in Computer Science Handbook of Logic in Artificial Intelligence and Logic Programming, Logical FoundationsBieber & Cuppens 1993] P. Bieber, F. Cuppens Deontic Logic in Computer Science IEEE Symposium on Security and Privacy, pp.181-2323, 1975.

]. M. Brown, A Logic of Comparative Obligation [Calas 1994] C. Calas Distributed File System over a Multilevel Secure Architecture Problems and Solutions, Second International Workshop on Deontic Logic in Computer Science Third European Symposium on Research in Computer Security (ESORICS 94), pp.37-55, 1994.

]. L. Catach, ]. F. Chen, R. S. Sandhu-]-r, and . Chisholm, [CC 1996a] CC, Common Criteria for Information Technology Security Evaluation, Part1: Introduction and general model, 60p., CCEB-96/011, version 1.0, 1996. [CC 1996b] CC, Common Criteria for Information Technology Security Evaluation, Part4: Predefined Protection Profiles, 166p., CCEB-96/014, version 1.0, 1996. [Chellas 1980] B. F. Chellas, Modal Logic: An Introduction, 295p Constraints for Role-Based Access Control Contrary-to-Duty Imperatives and Deontic Logic Analyzing Consistency of Security Policies, TABLEAUX: A General Theorem Prover for Modal Logics 1st ACM Workshop on Role-Based Access Control, NISTCholvy & Cuppens 1997] L. Cholvy, F. Cuppens IEEE Symposium on Security and Privacy Comparison of Commercial and Military Computer Security Policies IEEE Symposium on Security and Privacy, pp.489-51039, 1963.

A. Deswarte, M. Hawes, H. Kaâniche, T. Kurth, S. Manning et al., nominatives ayant pour fin la recherche dans le domaine de la santé SQUALE -Definition of Draft Criteria for the Assessment of Dependable Systems -Draft 2, ACTS Programme of the European Commission [CTCPEC 1993] CTCPEC, The Canadian Trusted Computer Product Evaluation Criteria, Canadian System Security Center, Communications Security Establishment, Governement of Canada, version 3.0e A Logical Analysis of Authorized and Prohibited Information Flows, Loi n°94-548 du 1° juillet 1994 relative au traitement de données Articles 47 et 48 du Code de Déontologie MédicaleCorneillie et al. 1997] P. Corneillie ACTS95/AC097, LAAS Report 97166 IEEE Symposium on Research in Security and Privacy, pp.100-109, 1979.

]. F. Cuppens, A Logical Formalization of Secrecy A Normative Framework for Security Policies [Cuppens 1994b] F. Cuppens Roles and Deontic Logic " , in Second International Workshop on Deontic Logic in Computer Science [Cuppens & Saurel 1996] F. Cuppens, C. Saurel Specifying a Security Policy: A Case Study Information Flow Controls vs Inference Controls: An Integrated Approach Implementing Secure Dependencies over a Network by Designing a Distributed Security SubSystem, Computer Security Foundations Workshop VI Towards a Global Expert System in Law (Conference in Celebration of the 25th Anniversary of the Istituto per la documentazione giuridica of the Consiglio Nationale delle Ricerche) 9th IEEE Computer Security Foundations Workshop Third European Symposium on Research in Computer Security Third European Symposium on Research in Computer Security (ESORICS 94), pp.53-62123, 1993.

&. Deswarte, Privilege Graph: an Extension to the Typed Access Matrix Model, Third European Symposium on Research in Computer Security (ESORICS 94), pp.317-334, 1994.

. Dacier, Models and tools for quantitative assessment of operational security, 12th IFIP Information Systems Security Conference (IFIP/SEC'96), pp.177-186, 1996.
DOI : 10.1007/978-1-5041-2919-0_15

]. J. David, Organizational Security -Clean Up or Cover Up ?, Computer & Security, vol.14, issue.2, pp.99-101, 1995.

]. A. Davis, Software Requirements : Objects, Functions, and States, 521p, 1993.

L. Deswarte, J. Blain, and . Fabre, Intrusion tolerance in distributed computing systems, Proceedings. 1991 IEEE Computer Society Symposium on Research in Security and Privacy, pp.110-12169, 1979.
DOI : 10.1109/RISP.1991.130780

]. E. Emersonfabre, Temporal and Modal Logic Tolérance aux fautes et sécurité par fragmentation-redondance-dissémination. Fault tolerance and security by fragmentation-redundancy-scattering, Technique et science informatiques, pp.995-1072405, 1990.

A. Del-cerro, D. Herzig, E. H. Farmer, D. Spafford, E. H. Farmer et al., Epistemic and Temporal Reasoning The COPS Security Checker System [Farmer & Spafford The COPS Security Checker System CSD-TR-94-993 [Federal Criteria 1992] Federal Criteria, Federal Criteria for Information Technology Security, National Institute of Standards and Technology (NIST) and National Security Agency (NSA), Volume I and II, Draft, 1992. [Fitting 1983] M. Fitting, Proof Methods for Modal and Intuitionistic Logics First-Order Modal Tableaux [Fitting 1993] M. Fitting Basic Modal Logic Demonstration of the Interactive Graph Visualization System daVinci, Modal Deduction with Applications in Epistemic and Temporal Logic Handbook of Logic in Artificial Intelligence and Logic Programming the Summer Usenix Conference Synthese Library (169), D. Reidel Publishing Company Handbook of Logic in Artificial Intelligence and Logic Programming DIMACS Workshop on Graph DrawingFröhlich & Werner 1996] M. Fröhlich, M. Werner, " daVinci V2.0.x Online Documentation, pp.499-594191, 1983.

&. D. Lunt-1992-]-t, T. F. Garvey, and . Lunt, Cover Stories for Database Security, Database Security, V: Status and Prospects, pp.363-380, 1991.

. Glasgow, A Logic for Reasoning About Security Security Policies and Security Models, Computer Security Foundations Workshop IEEE Symposium on Security and Privacy, pp.2-1311, 1982.

&. Haigh, ]. J. Young, W. D. Haigh, M. Young, W. Harrison et al., Extending the non-interference version of MLS for SAT On Synchronization and Security, IEEE Symposium on Security and Privacy Monotonic Protection Systems, pp.232-239367, 1978.

. Harrison, Protection in operating systems, Communications of the ACM, vol.19, issue.8, pp.461-470, 1976.
DOI : 10.1145/360303.360333

. Heydon, Miro: visual specification of security, IEEE Transactions on Software Engineering, vol.16, issue.10, pp.1185-1197, 1990.
DOI : 10.1109/32.60298

]. R. Hilpinen, Actions in Deontic Logic, Deontic Logic in Computer Science, pp.85-100, 1993.

]. G. Hughes and M. J. , An Introduction to Modal Logic [ITSEC 1991] ITSEC, Critères d'évaluation de la sécurité des systèmes informatiques, v1.2, 163 p., ISBN 92-826-3005-6 [ITSEM 1993] ITSEM, Manuel d'évaluation de la sécurité des technologies de l'information, Office des publications officielles des Communautés Européennes, pp.1-1, 1968.

]. A. Jones, M. Sergot-deswarte, G. Eizenberg, and J. Quisquater, Formal specification of security requirements using the theory of normative positions, Second European Symposium On Research In Computer Security (ESORICS 92) Deontic Logic in Computer Science, pp.103-121, 1992.
DOI : 10.1007/BFb0013894

. Jones, A Linear time algorithm for deciding security, 17th Annual Symposium on Foundations of Computer Science (sfcs 1976), pp.33-41, 1976.
DOI : 10.1109/SFCS.1976.1

&. Jonsher, D. Gerhardt, W. Jonsher, and . Gerhardtjoubert, A Role-Based Modelling of Access Control with the Help of Frames Medical Decision Aid: Logic Bases of the System SPHINX Law and Logic Storage Channels in Disk Arm Optimization, 7th International Conference and Exhibition on Information Security First International Logic Programming Conference IEEE Symposium on Research in Security and Privacy, pp.131-142210, 1972.

&. Kohl, ]. J. Neuman, C. Kohl, . Neuman-]-s, and . Kripke, The Kerberos Network Authentification Service (V5), Internet RFC 1510 A Completeness Theorem in Modal Logic, Journal of Philosophical Logic, vol.24, pp.1-14, 1959.

]. S. Kripke, Semantical Considerations on Modal Logic, Acta Philosophica Fennica, vol.16, pp.83-94, 1963.
DOI : 10.1007/978-3-0346-0145-0_16

]. G. Kuper, Logic Programming with Sets, 6th ACM Conference on Principles of Database Systems (PODS), pp.11-20, 1987.

]. G. Kuper, On the Expressive Power of Logic Programming with Sets Protection, 7th ACM Conference on Principles of Database Systems (PODS)Laffont & Ortalo 1997] J. Laffont, R. Ortalo, Editeur de politiques de sécurité utilisant le formalisme des logiques modales, LAAS-CNRS, Rapport 97064 5th Princeton Symposium on Information Sciences and Systems, pp.10-14, 1971.

]. L. Lawrence, T. Lee, R. Lipton, and L. Snyder, The role of roles, Guide de la Sûreté de Fonctionnement IEEE Symposium on Security and Privacy Synthese Library (112), D. Reidel, Dordrecht Foundations of Secure Computation, pp.15-2110, 1977.
DOI : 10.1016/0167-4048(93)90004-O

]. V. Lotz, ]. Mccullough, and ]. J. Mclean, Temporal Reasoning over Deontic Specifications Specifications for Multi-Level Security and a Hook-Up Property A Hookup Theorem for Multilevel Security Reasoning about Security Models Security Models and Information Flow, Deontic Logic in Computer Science IEEE Symposium on Security and Privacy IEEE Symposium in Security and Privacy IEEE Symposium on Research in Security and Privacy, pp.31-67141, 1987.

]. J. Mcleanmclean, Security Models A Formal Statement of the MMS Security Model, IEEE Symposium on Security and Privacy Deontic Logic in Computer Science, 317 p, pp.1136-1145, 1984.

]. J. Millen, N. H. Minsky, and A. Lockman, Covert Channel Capacity Ensuring Integrity by Adding Obligations to Privileges, IEEE Symposium on Security and Privacy 8th International Conference on Software Engineering, pp.60-6692, 1985.

I. Mohammed, D. M. Dilts-computers, &. Security, ]. A. Muffet, R. C. Miller et al., Controlling Logical Inference in Multilevel Database Systems [Moskowitz 1992] I. S. Moskowitz The Influence of Delay upon an Idealized Channel's Bandwidth An Insecurity Flow Model Simple Timing Channels The Amulet V3, IEEE Symposium on Security and Privacy IEEE Symposium on Research in Security and Privacy New Security Paradigms 1997 Workshop IEEE Symposium on Research in Security and Privacy Crack Version 4.1 ? A Sensible Password Checker for Unix " , publicly available by ftp with the crack4.1 software at ftp.cert.org, pp.661-671245, 1988.

R. G. Myers, R. C. Mcdaniel, A. S. Miller, A. Ferrency, B. D. Faulring et al., The Amulet environment: new models for effective user interface software development, CMU-CS-95-166-R2 & CMU-HCII-95-102-R2 IEEE Symposium on Security and Privacy Predictably Dependable Computing Systems, pp.347-36521, 1981.
DOI : 10.1109/32.601073

&. Ortalo, . Deswarte-1998a-]-r, Y. Ortalo, and . Deswarte, Management of Information System Security: Specification and Assessment, 14th International Conference on Advanced Science and Technology Library of Congress, pp.207-221, 1998.

&. Ortalo, . Deswarte-1998b-]-r, Y. Ortalo, and I. F. Deswarte, Quantitative Evaluation of Information System Security, 14th IFIP International Information Security C o n f e re n c e, 1998.

R. Ortalo, Y. Deswarte, and M. Kaâniche, Experimenting with quantitative evaluation tools for monitoring operational security, Dependable Computing for Critical Applications 6 Dependable Computing and Fault-Tolerant Systems, pp.307-328, 1997.
DOI : 10.1109/32.815323

G. K. Pigeaud-]-m, S. G. Reiter, and . Stubblebine, [Pörn 1977] I. Pörn, Action Theory and Social Science: Some Formal Models Towards Acceptable Metrics of Authentification Structured Analysis (SA): A Language for Communicating Ideas Towards a Deontic Logic Approach to Legal Rules, Synthese Library (120), D. Reidel, Dordrecht IEEE Symposium on Security and Privacy Second International Workshop on Deontic Logic in Computer Science, pp.20-2116, 1977.

]. J. Rushby, Formal Methods and the Certification of Critical Systems, 313p., SRI International, 1993.

]. R. Sandhu, The schematic protection model: its definition and analysis for acyclic attenuating schemes, Journal of the ACM, vol.35, issue.2, pp.404-432, 1988.
DOI : 10.1145/42282.42286

]. R. Sandhu-]-r and . Sandhu, Expressive Power of the Schematic Protection Model Lattice-Based Access Control Models Roles Versus Groups, 1st ACM Workshop on Role-Based Access Control, NIST, pp.59-989, 1992.

]. R. Sandhue, H. Bertino, G. Kurth, E. Martella, R. S. Montolivo et al., Role Hierarchies and Constraints for Lattice-Based Access Controls Role-Based Access Control Models, 4th European Symposium on Research in Computer Security (ESORICS'96), pp.65-79, 1146.

]. F. Santos and J. Carmo, A Deontic Logic Representation of Contractual Obligations, Deontic Logic in Computer Science, pp.244-257, 1993.

]. R. Saury, Le Secret Médical, Gestions hospitalières, issue.303, pp.120-125, 1991.

. Shmueli, Rewriting of rules containing set terms in a logic data language LDL, Proceedings of the seventh ACM SIGACT-SIGMOD-SIGART symposium on Principles of database systems , PODS '88, pp.15-28, 1988.
DOI : 10.1145/308386.308400

]. L. Snyder, Theft and conspiracy in the take-grant protection model, Journal of Computer and System Sciences, vol.23, issue.3, pp.333-347, 1981.
DOI : 10.1016/0022-0000(81)90069-6

]. D. Sutherland, A Model of Information, 9th NIST/NCSC National Computer Security Conference, 1986.

]. G. Trouessin, Quantitative evaluation of confidentiality by entropy calculation, Proceedings Computer Security Foundations Workshop IV, pp.12-21, 1991.
DOI : 10.1109/CSFW.1991.151564

]. G. Trouessin, Traitements Fiables de Données Confidentielles par Fragmentation-Redondance-Dissémination, Thèse de Doctorat, p.162, 1991.

]. J. Van-benthem, The Logic of Time, Synthese Library, 1983.

]. C. Weissman, BLACKER: security for the DDN examples of A1 security engineering trades, Proceedings 1992 IEEE Computer Society Symposium on Research in Security and Privacy, pp.286-292, 1992.
DOI : 10.1109/RISP.1992.213253

Y. Yu and V. E. Gligor, A formal specification and verification method for the prevention of denial of service, Proceedings. 1988 IEEE Symposium on Security and Privacy, pp.187-202, 1988.
DOI : 10.1109/SECPRI.1988.8111

]. A. Zakinthinos and E. S. Lee, The Composability of Non-Interference, Journal of Computer Security, vol.3, issue.4, pp.269-281, 1994.
DOI : 10.3233/JCS-1994/1995-3404