From Access Control to Trust Management, and Back – A Petition

Abstract

Abstract. In security too often services are understood not from first principles but via characteristic mechanisms used for their delivery. Access control had got tied up with DAC, MAC, RBAC and reference monitors. With developments in distributed systems security and with the opening of the Internet for commercial use new classes of access control mechanisms became relevant that did not fit into the established mold. Trust Management was coined as a term unifying the discussion of those mechanisms. We view trust as a placeholder that had its use in driving this research agenda, but argue that trust is so overloaded that it is now an impediment for further progress. Our petition asks for a return to access control and proposes a new framework for structuring investigations in this area. Denn eben wo

Role Performance Trust-Based Access Control for Protecting Sensitive Attributes

“…Therefore, in RPTBAC, URH database is assigned to store a user's experience and it will be calculated automatically by using weighing evidence. This notion is adapted from the work of Gollmann [14] where Figure 3 shows the calculation of a user's experience in a weighing evidence.…”

CATT: A Cloud Based Authorization Framework with Trust and Temporal Aspects

“…Unfortunately, this interest from the research community has resulted in several different synonyms for the word trust. It can be either an indicator for multi-level security, a synonym for evidence and reputation, it can be used to signify the origin authentication and can have other meanings in some other contexts, as discussed in [26]. Most of the research about trust has been for the computation of trust and these approaches range from history based approaches to the ones based on statistical methods [27].…”

Behavioural Evaluation of Reputation-Based Trust Systems

“…We find that the field currently suffers from a confusion of what kind of evidence simulation experiments can provide exactly, and there is a need for credibly evaluating the attack resistance and robustness of proposed systems [1]. We acknowledge that other attributes such as usability [2,3], viability [4], deployability [5] and adjustability to different business situations [6] require attention as well.…”

“…These simulations are typically based on fixed stereotypical behaviour patterns (e.g. [8]), which falls under the field of reliability rather than security [1].…”