Risk management for distributed authorization

Journal of Computer Security

Volumn 15, Issue 4, 2007, Pages 447-489

  Skalka, Christian ^a,b   Wang, X Sean ^a   Chapin, Peter ^a  

^a UNIVERSITY OF VERMONT   (United States)

^b University of Vermont   (United States)

Author keywords

Distributed authorization; Trust management logic

Indexed keywords

FORMAL LOGIC; INFORMATION MANAGEMENT; ONLINE SYSTEMS;

AUTHORIZATION RISK; DISTRIBUTED AUTHORIZATION; TRUST MANAGEMENT LOGIC;

RISK MANAGEMENT;

EID: 34249881318     PISSN: 0926227X     EISSN: None     Source Type: Journal    
DOI: 10.3233/JCS-2007-15402     Document Type: Article

References (25)

1. M. Abadi, M. Burrows, B. Lampson and G. Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems 15(4) (1993), 706-734.
2. A. Abdul-Rahman, The PGP trust model. EDI-Forum: The Journal of Electronic Commerce, April 1997.
3. S. Ajmani, D.E. Clarke, C.-H. Moh and S. Richman, ConChord: Cooperative SDSI certificate storage and name resolution, in: International Workshop on Peer-to-Peer Systems, January 2002.
4. S. Anderson, Constraint datalog in trust management. Master's thesis, University of Nebraska, 2003.
5. A.W. Appel and E.W. Felten, Proof carrying authentication, in: Proceedings of the 6th Conference on Computer and Communications Security, Singapore, November 1999, G. Tsudik, ed., ACM Press, 1999.
6. L. Bauer, Access control for the Web via proof-carrying authorization. PhD Thesis, Princeton University, 2003.
7. A. Birrell, B.W. Lampson, R.M. Needham and M.D. Schroeder, A global authentication service without global trust, in: IEEE Symposium on Security and Privacy, 1986, pp. 223-230.
8. M. Blaze, J. Feigenbaum, J. Ioannidis and A.D. Keromytis, RFC-2704: The KeyNote Trust-Management System Version 2. IETF, September 1999.
9. M. Blaze, J. Feigenbaum and J. Lacy, Decentralized trust management, Technical Report 96-17, DIMACS, June 28 1996.
10. M. Burrows, M. Abadi and R. Needham, A logic of authentication, ACM Transactions on Computer Systems 8(1) (1990), 18-36.
11. P. Chapin, C. Skalka and X.S. Wang, Risk assessment in distributed authorization, in: Proceedings of the ACM Workshop on Formal Methods in Security Engineering, 2005.
12. D. Denning, A lattice model of secure information flow, in: Communications of the ACM, ACM, May 1976, pp. 236-243.
13. C. Ellison, B. Frantz, B. Lampson, R. Rivest, B. Thomas and T. Ylonen, SPKI certificate theory. RFC 2693, September 1999.
14. T. Grandison and M. Sloman, A survey of trust in internet applications, IEEE Communications Surveys & Tutorials, 4th Quarter, 2000.
15. C.A. Gunter and T. Jim, Policy-directed certificate retrieval, Software: Practice & Experience 30(15) (2000), 1609-1640.
16. F. Hong, X. Zhu and S. Wang, Delegation depth control in trust-management system, in: AINA'05: Proceedings of the 19th International Conference on Advanced Information Networking and Applications, IEEE Computer Society, Washington, DC, USA, 2005, pp. 411-414.
17. International Telecommunications Union, Information Technology - Open Systems Interconnection - The Directory: Public Key and Attribute Certificate Frameworks, 2000.
18. A. Jøsang, An algebra for assessing trust in certification chains, in: Proceedings of the Network and Distributed Systems Security Symposium (NDSS'99) J. Kochmar, ed., The Internet Society, 1999.
19. N. Li and J.C. Mitchell, Rt: A role-based trust-management framework, in: Proceedings of the Third DARPA Information Survivability Conference and Exposition, IEEE Computer Society Press, April 2003, pp. 201-212.
20. N. Li, J.C. Mitchell and W.H. Winsborough, Design of a role-based trust-management framework, in: Proceedings of the 2002 IEEE Symposium on Security and Privacy, IEEE Computer Society Press, May 2002, pp. 114-130.
21. N. Li, W.H. Winsborough and J.C. Mitchell, Distributed chain discovery in trust management, Journal of Computer Security 11(1) (2003), 35-86.
22. M.K. Reiter and S.G. Stubblebine, Authentication metric analysis and design, ACM Transactions on Information Systems Security 2(2) (1999), 138-158.
23. R. Rivest and B. Lampson, SDSI - a simple distributed security infrastructure, 1996. http://theory.lcs.mit.edu/rivest/sdsill.html
24. S. Schwoon, S. Jha, T.W. Reps and S.G. Stubblebine, On generalized authorization problems, in: CSFW, IEEE Computer Society, 2003, pp. 202-.
25. C. Skalka and X.S. Wang, Trust but verify: Authorization for web services, in: ACM Workshop on Secure Web Services, October 2004.