Date post: | 17-Jan-2016 |
Category: |
Documents |
Upload: | ophelia-hart |
View: | 215 times |
Download: | 0 times |
Decentralized Trust Management
security1.win.tue.nl/~zannone/teaching/dtm09-10.html
Course Organization
Introduction
AC, DTM topics based on research papersNext week: Discretionary Access Control
Website: List of TopicsPapers to read
security1.win.tue.nl/~zannone/teaching/dtm09-10.html
The need for Data Protection Confidential data
Databases with essential business information
Private data EHR, RFID, OVchip, `Slimme meter’
Risks & Threats. News headlines: Justice demanded pictures ov-chipcard travelers Laptop with data 109.000 persons stolen Data hacked vacancy website used for phishing ...
The need for Trust
Decision on interaction with other entity:Value to give to information in this lecture.Give access to a resource.
Incomplete information Is the information correct, state-of-the-art?How will the resource be used?
Trust Management
Establishing trust in the digital world
Truster Trustee
Gives Trust Subjective, perceived probability
Claims/Shows Trustworthiness
Trust me I’m a
doctor
Controlling access to resources Who is trusted to do what with a resource
Subject, Action, Object
I’m BobBob May
Park
Access Control MatrixPolicy:
Students may read grade list and read and run submitPaper
Teacher may read and write grade list and submitPaper
So we are done ?
User GradeList SubmitPaper
Jerry rw rw
Joris r rx
Tim r rx
Controlling access to resources Enforcement, Implementation
Maintenance, Consistency Captures intended policy (how to check?) Dynamicity; Rights not constant
Specification, Policies Authority on the resource; Who decides?
Decentralized systems, Delegation. Conditions, Obligation, Purpose
Privacy Anonymity, attribute based AC
CENSORED
Access Control Lists
Enforcement & Maintenance
User GradeList SubmitPaper
Jerry rw rw
Joris r rx
Tim r rx
User SubmitPaper
Jerry rw
Joris rx
Tim rx
Role base access control(1)
Role (Similar to `group’) Teacher Student
Assign access rights to Roles and Roles to users Added Indirection makes for easier maintenance
Role GradeList
Teacher rw
Student r
Role Users
Teacher Jerry
Student Joris, Tim
1) RBAC treated in more detail in a later lecture.
Role dependency (Role Hierarchies)
Staff
Prof Lecturer
Scientific Financial
...
Legal
...
Staff may Enter BuildingStaff rights also granted to Professors
Decentralized AC
Different authorities at different locationsUT admin does not control TU/e resources
Different Hierarchies for different locations In NL PhD student is subrole of Employee in US PhD student is subrole of Student
Access control for distributed resources?TU/e student list, US student discount.
Delegation Define your roles based on roles of other users:
Jerry.StudentsInMyClass = EducationOffice.RegisteredStudents2IS25
Trust Management Issue: I trust education office to define registered student
role In turn education office may trust registration office
EducationOffice.RegisteredStudents2IS25 = RegistrationOffice.Student and WebServer.subscribed2IS25
Towards Rule based TM Can specify `trust rules’
Link roles in different HierarchiesDifficulty: Naming Conventions
e.g. AIO – PhD student
More fine grained control Different Roles for different users/locations
Jerry.StudentsInMyClassSandro.StudentsInMyClassEducationOffice.RegisteredStudents2IF34
Why trust?
Trust needed for cooperation Cannot control behaviour of other people/systems
Base of trust Own experience and experience of others Regulations Technical measures (see also next slide) Taking a risk (risk vs benefit analysis when possible)
`Good’ behaviour slowly enforces/builds trust `Bad’ behaviour quickly lowers trust
Why Trust (Cont.) ?
Trusting remote computationTrusted computing platform
Hardware chip base chain of trust – chip checks signatures of programs to ensure they are not altered, can do essential computation steps.
Smartcards protect information, applications from device holder
Trust Management
Main TM classes Rule based TM
E.g. based on Regulations Trusted parties can be exactly determined trust ~ formal relationship
Reputation based TM E.g. when based on behaviour, recommendations trust ~ subjective probability `correct’ behaviour
Trust me I’m a
doctor
Rule Based Trust Management
Example systemsRole based trust management (RT)SDKI/SPKI…
Example scenarioStudent at accredited university gets discount
Shop.Discount ← AccBody.Univ.Student
AccBody.Univ ← TUe
TUe.Student ← Alice
Rule Based Trust Management
Distributed, Open Each participant is authority, issues credentials Participants can join, leave
Delegation entrust credentials of others
Binary User either fully trusted or not trusted
Static trust level No change based on actions of the user
Reputation System Example E-bay transaction feedback system
Eigentrust: More advanced combination
Reputation Systems Scenario
Joint ordering to get bulk discount More participants = more savings Do have to show up when the book arrives Allow friends to join & recommend others
Alice joinsBob does not join but recommends CharlieCharlie does not join but recommends Dave...
Reputation Based TM
Main properties Distributed, Open
Each participant is an authority Issues its own recommendations/feedback.
Delegation Place trust in the recommendations of others.
Multilevel and dynamic trust level level of trust actions influences the level of trust
Common features TM classes
Combine info from different sources trust sources providing information
Openness; Anyone can join or leave the system issue credentials/recommendations
Other participants decide on their value
Differences TM classes Role of risk:
In rule based systems certificates state factsReputation systems include intrinsic risk;
reputation does not give any guarantees.
(“ In het verleden behaalde resultaten geven geen garantie voor de toekomst ”)
Yes / No verses numerical. Reputation changes with actions;
level of trust is dynamic.
Back to specification of access rights
AC matrix snapshot for single location TM meant to link locations
Policies to capture `rules’ Rules underlie the permissions in AC matrixDerive, Update, Maintain permissionsE.g. Logic in access control
Logic in Access Control
Express AC rules with logical formulas:Rights expressed by predicates:
may-access(p,o,r):
principle p has access right r to object o
Basic rules can also be expressed: may-access(p,o,Wr) → may-access(p,o,Rd)
write access implies read access
Different ways to generalize this principle
Logic in Access Control (2)
Complications of distributed systems Often used construct: `SAYS’
for stating requests for delegation, e.g. p says may-access(q,o,r)
p says may-access(q,o,r)=>( may-access(p,o,r) => may-access(q,o,r))
Expressing the intended policy
AC matrix not expressive enough e.g. no rules
Just add anything you can think of ?
Limit on expressiveness Illustrate with Take-grant model
Take-Grant model
Directed graph represents AC matrix. Edge Role -- Object labeled with right (e.g. read/write)
Delegation rights added Edge between Roles: can take/may grant rights
Changes in response to delegation actions Rules for changing graph
Take-Grant Model example
File
R,W
Alice Bobt
File
R,W
Alice Bobt
R,W
Example of an application of the Take-rule; Bob takes Alice’s read/write permission
Safety problem
Can subject obtain a right? Given delegation rules, initial permissions: can a given permission can be granted ?
Decidable in linear time if delegation rules fixed to Take-grant model [Jone76].
Undecidable in general (details next week) Not possible to create algorithm
Takes as input set of rules and starting configuration Always stops with the correct decision. (Equivalent to the Turing halting problem.)
Implications Undecidability of safety shows limits; AC policy language cannot be too expressive
Efficiently decide whether uses have a right Check safety properties before granting right Complexity in understanding
Difficulty: find AC specification mechanism
simple to understand effectively computable sufficiently expressive
Implementation: Certificates Proof that you are a member of a role
Student card issued by registration office
More generally: Binding of properties to an identity (public key) signed by the cerfitication authority (i.e. issuer of the role student).
Proof that a role is defined in a given way Education office can issue a single certificate stating
EducationOffice.RegisteredStudents2IF34 = RegistrationOffice.Student and WebServer.subscribed2IF34
rather than given a different certificate to each student
Using Certificates
Use a chain of certificates to proof role membershipStudent card to proof studentconfirmation from webserver to show
registeredcertificate of education office to show
registration policy (Automatic) Chain discovery can be difficult
who stores certificateswhere to look for certificates
PKI & certificate systems PKI
Public key cryptosystem, e.g. RSA Certificate links public key to identity. Trust based on authority that signs
Trusted roots predefined in web browser trust by numbers (PGP)
examples of PKI/certificate based systems: X.509 – Certificates bind a public key to a name(string) SPKI: PKI with focus on authorization (rather than
authentication), binding properties directly to public keys Kerberos: Single sign on system; the user gets a `ticket’ for use
of a service. Ticket is a form of certificate PGP: Often used for encryption and signing of email. No central
CAs for distribution of public keys.
Conclusions Basics of decentralized trust management
Distributed access control Delegation control
Remaining Lectures treat Access Control Privacy Policies Rule based Trust Management Reputation Systems Applications of TM Systems
Please check papers, info at: security1.win.tue.nl/~zannone/teaching/dtm09-10.html
Recommended Reading
Decentralized Trust Management, M. Blaze et al. the PolicyMaker trust management system.comparison with X.509 and PGP.
Formal Models for Computer Security, C. LandwehrOverview of classical data security notions and
systems
The End