Search

Trust Management is an approach to construct and interpret the trust relationships among public-keys that are used to mediate security-critical actions. Cryptographic credentials are used to specify delegation of authorisation among public keys. Existing trust management schemes are operational in nature, defining security in terms of specific controls such as delegation chains, threshold schemes, and so forth. However, they tend not to consider whether a particular authorisation policy is well designed in the sense that a principle cannot somehow bypass the intent of a complex series of authorisation delegations via some unexpected circuitous route. In this paper we consider the problem of authorisation subterfuge, whereby, in a poorly designed system, delegation chains that are used by principals to prove authorisation may not actually reflect the original intention of all of the participants in the chain. A logic is proposed that provides a systematic way of determining whether a particular delegation scheme using particular authorisation is sufficiently robust to be able to withstand attempts at subterfuge. This logic provides a new characterisation of certificate reduction that, we argue, is more appropriate to open systems. [ABSTRACT FROM AUTHOR]

Service oriented architectures provide a simple yet flexible model of a computing system as a graph of services making requests and providing results to each other. In this paper we define a formal model of a service oriented architecture and using it, we define metrics for performance, for availability, and for various security properties. These metrics serve as the basis for expressing the business requirements. To make trade-offs possible we also define a set of cost metrics, denominated in a uniform currency, to measure the cost of not meeting a requirement. The model, the property metrics, and the cost metrics are then used to generate a Constraint Satisfaction Problem where the objective function is set to minimize the aggregate system cost. We have written these constraints and defined realistic requirements in OPL and we have used them to generate system configurations that minimize the overall cost by optimally trading off the business requirements. [ABSTRACT FROM AUTHOR]

We've been looking at what we call the security protocol negotiation problem. People who use security protocols to authenticate, do key exchange, or whatever, are typically stuck with using whatever protocol is available. If the participants can't agree on a suitable protocol, then they don't get to use each other's services. We are interested in self-configuring security protocols where the participants have to say what their requirements are and synthesise or con.gure their own suitable protocol that would meet their respective goals. If we have this idea of self-configuring security protocols then, as a consequence, we also have selfhealing security protocols. If the requirements change, or if the assumptions about our principals and keys change, then we have this ability to recon.gure and produce a security protocol that will meet those new goals, based on those assumptions. [ABSTRACT FROM AUTHOR]

This paper proposes a belief logic based approach that allows principals to negotiate and on-the-fly generate security protocols. When principals wish to interact then, rather than offering each other a fixed menu of ‘known' protocols, they negotiate and generate a new protocol that is tailored specifically to their current security environment and requirements. This approach provides a basis for autonomic security protocols. Such protocols are self-configuring since only principal assumptions and protocol goals need to be a-priori configured. The approach has the potential to survive security compromises that can be modelled as changes in the beliefs of the principals. A compromise of a key or a change in the trust relationships between principals can result in a principal self-healing and synthesising a new protocol to survive the event. [ABSTRACT FROM AUTHOR]

Mandatory label-based policies may be used to support a wide-range of application security requirements. Labels encode the security state of system entities and the security policy specifies how these labels may change. Building on previous results, this paper develops a model for a kernelized framework for supporting these policies. The framework provides the basis for, what is essentially, an interpreter of multilevel programs: programs that manipulate multilevel label data-structures. This enables application functionality and security concerns to be developed separately, bringing with it the advantages of a separation of concerns paradigm. [ABSTRACT FROM AUTHOR]