Trust but verify

Abstract

Through web service technology, distributed applications can be built in a exible manner, bringing tremendous power to applications on the web. However, this exibility poses signicant challenges to security. In particular, an end user (be it human or machine) may access a web service directly, or through a number of intermediaries, while these intermediaries may be formed on the y for a particular task. Traditional access control for distributed systems is not exible and ecient enough in such an environment. Indeed, it may be impossible for a web service to anticipate all possible access patterns, hence to dene an appropriate access control list beforehand. Novel solutions are needed.This paper introduces a trust-but-verify framework for web services authorization, and provides an implementation example. In the trust-but-verify framework, each web service maintains authorization policies. In addition, there is a global set of trust transformation rules, each of which has an associated transformation condition. These trust transformation rules convert complicated access patterns into simpler ones, and the transformation is done by a requester (the original requester or an intermediary) with the assumption that the requester can be trusted to correctly omit certain details. To verify authorization, the requester is required to document evidence that the associated transformation conditions are satised. Such evidence and support information can either be checked before access is granted, or can be veried after the fact in an oine mode, possibly by an independent third party.

A framework towards enhancing trust and authorisation for e-commerce service

“…Three types of digital certificates are used: identity certificates for authentication, attribute certificates for authorisation and access-rule certificates for propagation of access control. The authors use a subset of the full Skalka and Wang (2004) logic, which they will describe in Section 3. In the authors' implementation approach, they propose the use of digital certificates, SSL and secures electronic transactions (SET) to be used in conjunction with access control intermediates.…”

“…Although ABLP logic is undecidable in general, various presentations have described non-trivial, decidable access control mechanisms (Wallach et al, 2000;Skalka and Wang, 2004). s s s s ′ ′⊃ Naturally, it is desirable for authorisation judgments to be decidable.…”

“…As the trust transformation injects trust into authorisation, offline checking inverts the trust transformation, to verify online trust in the offline phase that is, given a trusted request offline checking searches for an extrapolated request of which is the trust transform (Skalka and Wang, 2004). As the trust transformation injects trust into authorisation, offline checking inverts the trust transformation, to verify online trust in the offline phase that is, given a trusted request offline checking searches for an extrapolated request of which is the trust transform (Skalka and Wang, 2004).…”

“…The reason for this is that: 1 the actual verification is costly if done for each transaction 2 more importantly, it is in any reputable vendor's best interest to be a good a citizen, hence, problems occur only rarely (Skalka and Wang, 2004). The vendor needs to access the card-issuing bank to check the credit card information and obtain payment confirmation; this involves a distributed authorisation problem.…”

“…Most closely related works in this regard is proof carrying authorisations (PCA) by Appel and Felten (1999) and Bauer (2003), a framework for specifying and enforcing web page access policies (though the logic used there is not ABLP, but an application specific variant) (Skalka and Wang, 2004). The bank can also request a general audit of vendors.…”