Distributed Trust Management

Semester 1, Kwartiel 1.

Course code: 215020

Time: on Monday, from 15:45 till 17:25

Place: LA A217B (Langezijds - number 17 on http://www.utwente.nl/dienstverlening/route/)

VIST link (with course description etc): http://webapps.utwente.nl/vist/en/vistservlet?node=VistVakinfoResultNode&details=true&vak_code=215020&studie_jaar=2007

Teletop link (I tend not to use it): http://teletopb.civ.utwente.nl/07215020.nsf

Course Material

• The slides.
• The essay to obtain 6ECTS still has to be prepared according to these guidelines. More information can be found in the slides of the 7th lecture.
• Lectures and recommended readings:
  1. Introduction (September 3rd)
     • Formal models for computer security Landwehr: http://portal.acm.org/citation.cfm?coll=GUIDE&dl=GUIDE&id=356852. (local copy here).
     • Decentralized Trust Management, M. Blaze et al. http://citeseer.ist.psu.edu/blaze96decentralized.html.
  2. Access control models.
     • Lattice-based Access Control Models, by R. Sandhu http://www.winlab.rutgers.edu/~trappe/Courses/AdvSec05/access_control_lattice.pdf.
     • Role-based Access Control Models by R. Sandhu et al. http://citeseer.ist.psu.edu/sandhu96rolebased.html
     • (suggested reading) SDSI a simple distributed security infrastructure, by Rivest and Lampson http://theory.lcs.mit.edu/~rivest/sdsi10.ps
     • Logic in Access Control by M. Abadi. LICS 2003. http://www.cse.ucsc.edu/~abadi/Papers/lics2003.pdf
  3. Rule based trust management (I).
     • Ninghui Li, John C. Mitchell, William H. Winsborough: Design of a Role-Based Trust-Management Framework. IEEE Symposium on Security and Privacy 2002: 114-130.http://crypto.stanford.edu/~ninghui/papers/rt_oakland02.pdf
     • Czenko, M.R. and Etalle, S. and Li, D. and Winsborough, W.H. (2007) An Introduction to the Role Based Trust Management Framework RT. Technical Report TR-CTIT-07-34 Centre for Telematics and Information Technology, University of Twente, Enschede.
     • Suggested readings: Marianne Winslett: An Introduction to Trust Negotiation. iTrust 2003: 275-283. http://cdr.cs.uiuc.edu/pubs/winslett/itrust03.ps
  4. Rule based trust management (II).
     • Ninghui Li, William H. Winsborough, John C. Mitchell: Distributed Credential Chain Discovery in Trust Management. (the type system and the forward and backward algorithms) Journal of Computer Security 11(1): 35-86 (2003). http://crypto.stanford.edu/dc/papers/disc.pdf
  5. Privacy and Auditing.
     • The Audit Logic: Policy Compliance in Distributed Systems Cederquist, J.G. and Corin, R.J. and Dekker, M.A.C. and Etalle, S. and den Hartog, J.I. and Lenzini, G. report version available at http://eprints.eemcs.utwente.nl/2773/
     • Audit-Based Access Control for Electronic Health Records Dekker, M.A.C. and Etalle, S. report version available on http://eprints.eemcs.utwente.nl/6994/
     • (Suggested) Privacy in an Ambient World. Dekker, M.A.C. and Etalle, S. and den Hartog, J.I. report version available on http://eprints.eemcs.utwente.nl/5700/
  6. Advanced topic in rule based trust management. Here the slides are the the most important part
     • (not the algorithm, just the language and the examples) Czenko, M.R. and Tran, H.M. and Doumen, J.M. and Etalle, S. and Hartel, P.H. and den Hartog, J.I. (2005) Nonmonotonic Trust Management for P2P Applications. http://eprints.eemcs.utwente.nl/5738/
     • (again, not the algorithm, just the language and the examples) Etalle, S. and Winsborough, W.H. (2005) Integrity Constraints in Trust Management (Extended Abstract). In: 10th ACM Symp. on Access Control Models and Technologies (SACMAT), Stockholm, Sweden. pp. 1-10. ACM Press. http://eprints.eemcs.utwente.nl/698/
  7. Advanced issues.
     • Lampson, Protection. http://research.microsoft.com/~lampson/08-Protection/WebPage.html
     • Harrison, Ruzzo and Ullman, Protection in Operating Systems.harrison-ruzzo-ullman.pdf
     • (optional) Li, Winsborough, Mitchell, Beyond Proof-of-compliance: Safety and Availability Analysis in Trust Management (only sections 1,2 and 5). http://citeseer.ist.psu.edu/li03beyond.html.
  8. Reputation systems.
     • S. D. Kamvar, M. T. Schlosser, and H. Garcia-Molina. The EigenTrust Algorithm for Reputation Management in P2P Networks. In Proceedings of the Twelfth International World Wide Web Conference, 2003. http://citeseer.ist.psu.edu/kamvar03eigentrust.html
     • A. Josang, Reputation Systems, also available at http://sky.fit.qut.edu.au/~josang/papers/Jos2007-FOSAD.pdf
     • (optional) P. Resnick, R. Zeckhauser, E. Friedman, and K. Kuwabara. Reputation systems. Communications of the ACM, 43(12), 2000. http://www.si.umich.edu/~presnick/papers/cacm00/index.html