The Role of Trust Management in Distributed Systems Security

Abstract

Abstract. Existing authorization mechanisms fail to provide powerful and robust tools for handling security at the scale necessary for today's Internet. These mechanisms are coming under increasing strain from the development and deployment of systems that increase the programmability of the Internet. Moreover, this "increased flexibility through programmability" trend seems to be accelerating with the advent of proposals such as Active Networking and Mobile Agents. The trust-management approach to distributed-system security was developed as an answer to the inadequacy of traditional authorization mechanisms. Trust-management engines avoid the need to resolve "identities" in an authorization decision. Instead, they express privileges and restrictions in a programming language. This allows for increased flexibility and expressibility, as well as standardization of modern, scalable security mechanisms. Further advantages of the trust-management approach include proofs that requested transactions comply with local policies and system architectures that encourage developers and administrators to consider an application's security policy carefully and specify it explicitly. In this paper, we examine existing authorization mechanisms and their inadequacies. We introduce the concept of trust management, explain its basic principles, and describe some existing trust-management engines, including PoHcyMaker and KeyNote. We also report on our experience using trust-management engines in several distributed-system applications.

Secure Component Distribution Using WebCom

“…For the purposes of illustration, only simple examples are presented in this paper. The reader is referred to [3] for a discussion of the expressiveness of KeyNote.…”

Access Control Framework for Delay/Disruption Tolerant Networks

“…The classical AAA architecture and the above mentioned credential/policy-based distributed trust models are not suitable for direct implementation in DTN due to: design principle, operational complexity, scalability issue and unavailability during long/variable delay and frequent disruption [25], [26]. However, the implementation flexibility offered by the AAA standard and the applicability of certain concepts with slight modification to the DTN environment underlines the suitability of AAA architecture concept to DTN.…”

Weighted Pushdown Systems and Trust-Management Systems

“…For notational convenience, we will write the labeled rewrite rule (L −→ R, T ) as L T −→ R. We will treat certs as labeled rewrite rules: 3 -A name cert (K, A, S, V ) will be written as a labeled rewrite rule K A −→ S, where is the authorization specification such that for all other authorization specifications t, ∩ t = t, and ∪ t = . 4 Sometimes we will write −→ as simply −→, i.e., a rewrite rule of the form L −→ R has an implicit label of . …”

“…In trust-management systems [4,5,25], such as SPKI/SDSI [9], the security policy is given by a set of signed certificates, and a proof of authorization consists of a set of certificate chains. In SPKI/SDSI, the principals are the public keys, i.e., the identity of a principal is established by checking the validity of the corresponding public key.…”