SD3: a trust management system with certified evaluation

Jim, Trevor

doi:10.1109/secpri.2001.924291

Cited by 183 publications

(159 citation statements)

References 14 publications

Supporting

Mentioning

158

Contrasting

Order By: Relevance

“…The work by Jim and Suciu on SD3 [16,17], the successor of QCM, is also related to ours. SD3 is a trust-management system based on Datalog that, like our algorithms, allows for distributed evaluation of authorization queries.…”

Section: Related Worksupporting

confidence: 61%

“…SD3 is a trust-management system based on Datalog that, like our algorithms, allows for distributed evaluation of authorization queries. In [16], the author claims that SD3 can express "roughly the same policies as SDSI 2". While this claim is not further substantiated in [16], we believe it to be true.…”

Section: Related Workmentioning

confidence: 99%

“…In [16], the author claims that SD3 can express "roughly the same policies as SDSI 2". While this claim is not further substantiated in [16], we believe it to be true. However, there are several differences that set our work apart from SD3: -SD3 describes a generic evaluation algorithm where each instantiation corresponds to a particular strategy for distributing the computation.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Weighted Pushdown Systems and Trust-Management Systems

Jha¹,

Schwoon

Wang³

et al. 2006

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. The authorization problem is to decide whether, according to a security policy, some principal should be allowed access to a resource. In the trustmanagement system SPKI/SDSI, the security policy is given by a set of certificates, and proofs of authorization take the form of certificate chains. The certificate-chain-discovery problem is to discover a proof of authorization for a given request. Certificate-chain-discovery algorithms for SPKI/SDSI have been investigated by several researchers. We consider a variant of the certificate-chain discovery problem where the certificates are distributed over a number of servers, which then have to cooperate to identify the proof of authorization for a given request. We propose two protocols for this purpose. These protocols are based on distributed model-checking algorithms for weighted pushdown systems (WPDSs). These protocols can also handle cases where certificates are labeled with weights and where multiple certificate chains must be combined to form a proof of authorization. We have implemented these protocols in a prototype and report preliminary results of our evaluation.

show abstract

Section: Related Worksupporting

confidence: 61%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Weighted Pushdown Systems and Trust-Management Systems

Jha¹,

Schwoon

Wang³

et al. 2006

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

show abstract

“…Policies are declarative statements over data from requests and over relations that capture information gathered by the application (such as conflict-of-interest data). Following many other policy models [5,12,23,29,30], we capture policies as Datalog programs.…”

Section: Modeling Policies and Their Dynamic Environmentsmentioning

confidence: 99%

“…Datalog is the foundation for many access-control and related frameworks [5,12,23,29,30,34]. These works support only non-temporal query evaluation, while we are targeting richer analyses.…”

Section: Related Workmentioning

confidence: 99%

Specifying and Reasoning About Dynamic Access-Control Policies

Dougherty¹,

Fisler²,

Krishnamurthi

2006

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Access-control policies have grown from simple matrices to non-trivial specifications written in sophisticated languages. The increasing complexity of these policies demands correspondingly strong automated reasoning techniques for understanding and debugging them. The need for these techniques is even more pressing given the rich and dynamic nature of the environments in which these policies evaluate. We define a framework to represent the behavior of accesscontrol policies in a dynamic environment. We then specify several interesting, decidable analyses using first-order temporal logic. Our work illustrates the subtle interplay between logical and state-based methods, particularly in the presence of three-valued policies. We also define a notion of policy equivalence that is especially useful for modular reasoning.

show abstract

Interoperable semantic access control for highly dynamic coalitions

Koshutanski

Maña

2010

Security Comm Networks

View full text Add to dashboard Cite

A coalition consists of independent organizations that share resources and skills to achieve significant mission objectives. Dynamic Coalition (DC) formations occur in response to some market demands, business requests, or disaster responses, to name a few. Partners forming a coalition are automatically selected given some business criteria and become active participants from the time the coalition is formed. Highly dynamic coalitions (HDCs) form a sub class of dynamic coalitions where the coalition formation and operation are strictly bound by time in order to provide a prompt reaction to some events. This type of dynamism poses the necessity of underlying security models and technologies allowing for automated coalition formation and operation. This paper presents a platform-driven approach to HDCs. It first defines a life cycle inherent to HDC formations, and then presents a platform-driven access control model that takes advantage of semantics of partners' requirements to provide interoperable access control to resources shared in a coalition. Coalition partners can achieve a high level of service interoperation by enhancing their access control requirements with semantics of usage, and interlinking their semantics using class relations based on standard ontology. ‡ Digital Ecosystems EU initiative-http://www.digitalecosystems.org; EU FP6 ECOLEAD project-http:// ecolead.vtt.fi possibility of providing combined services adapted to some client's requests. The dynamism in this case is often limited, as normally the coalition is static after it is formed, but sometimes the dynamism is extended to cover partner replacement during coalition operation. However, time scales for coalition formation and restructuring are long, thus allowing that these processes include some human intervention or complex

show abstract

SD3: a trust management system with certified evaluation

Cited by 183 publications

References 14 publications

Weighted Pushdown Systems and Trust-Management Systems

Weighted Pushdown Systems and Trust-Management Systems

Specifying and Reasoning About Dynamic Access-Control Policies

Interoperable semantic access control for highly dynamic coalitions

Contact Info

Product

Resources

About