The Traust Authorization Service

ABSTRACT

In recent years, trust negotiation has been proposed as a novel authorization solution for use in open-system environments, in which resources are shared across organizational boundaries. Researchers have shown that trust negotiation is indeed a viable solution for these environments by developing a number of policy languages and strategies for trust negotiation that have desirable theoretical properties. Further, existing protocols, such as TLS, have been altered to interact with prototype trust negotiation systems, thereby illustrating the utility of trust negotiation. Unfortunately, modifying existing protocols is often a time-consuming and bureaucratic process that can hinder the adoption of this promising technology.

In this paper, we present Traust, a third-party authorization service that leverages the strengths of existing prototype trust negotiation systems. Traust acts as an authorization broker that issues access tokens for resources in an open system after entities use trust negotiation to satisfy the appropriate resource access policies. The Traust architecture was designed to allow Traust to be integrated either directly with newer trust-aware applications or indirectly with existing legacy applications; this flexibility paves the way for the incremental adoption of trust negotiation technologies without requiring widespread software or protocol upgrades. We discuss the design and implementation of Traust, the communication protocol used by the Traust system, and its performance. We also discuss our experiences using Traust to broker access to legacy resources, our proposal for a Traust-aware version of the GridFTP protocol, and Traust's resilience to attack.

REFERENCES

• 1: Allcock, W. 2003. GridFTP protocol specification. Global Grid Forum Recommendation GFD.20. ⟨http://www.globus.org/alliance/publications/papers/GFD-R.0201.pdf⟩.
• 2: Basney, J. 2005. MyProxy protocol. Global Grid Forum Experimental Document GFD-E.54.
• 3: Jim Basney , Marty Humphrey , Von Welch, The MyProxy online credential repository: Research Articles, Software—Practice & Experience, v.35 n.9, p.801-816, July 2005 [doi>10.1002/spe.v35:9]
• 4: Lujo Bauer , Scott Garriss , Michael K. Reiter, Distributed Proving in Access-Control Systems, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.81-95, May 08-11, 2005 [doi>10.1109/SP.2005.9]
• 5: Cassandra: Distributed Access Control Policies with Tunable Expressiveness, Proceedings of the Fifth IEEE International Workshop on Policies for Distributed Systems and Networks, p.159, June 07-09, 2004
• 6: T. Berners-Lee , R. Fielding , L. Masinter, Uniform Resource Identifiers (URI): Generic Syntax, RFC Editor, 1998
• 7: T. Berners-Lee , L. Masinter , M. McCahill, Uniform Resource Locators (URL), RFC Editor, 1994
• 8: E. Bertino , E. Ferrari , A. Squicciarini, X -TNL: An XML-based Language for Trust Negotiations, Proceedings of the 4th IEEE International Workshop on Policies for Distributed Systems and Networks, p.81, June 04-06, 2003
• 9: Trust-X: A Peer-to-Peer Framework for Trust Establishment, IEEE Transactions on Knowledge and Data Engineering, v.16 n.7, p.827-842, July 2004 [doi>10.1109/TKDE.2004.1318565]
• 10: Blakley, G. R. 1979. Safeguarding cryptographic keys. In AFIPS Conference Proceedings. Vol. 48. 313--317.
• 11: Piero Bonatti , Pierangela Samarati, Regulating service access and information release on the Web, Proceedings of the 7th ACM conference on Computer and communications security, p.134-143, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352620]
• 12: Kevin Borders , Xin Zhao , Atul Prakash, CPOL: high-performance policy evaluation, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102142]
• 13: Jan Camenisch , Els Van Herreweghen, Design and implementation of the idemix anonymous credential system, Proceedings of the 9th ACM conference on Computer and communications security, November 18-22, 2002, Washington, DC, USA [doi>10.1145/586110.586114]
• 14: T. Dierks , C. Allen, The TLS Protocol Version 1.0, RFC Editor, 1999
• 15: Dolev, D. and Yao, A. C. 1983. On the security of public key protocols. IEEE Trans. Inform. Theory IT-29, 2 (March) 198--208.
• 16: Amir Herzberg , Yosi Mass , Joris Michaeli , Yiftach Ravid , Dalit Naor, Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.2, May 14-17, 2000
• 17: Adam Hess , Jason Holt , Jared Jacobson , Kent E. Seamons, Content-triggered trust negotiation, ACM Transactions on Information and System Security (TISSEC), v.7 n.3, p.428-456, August 2004 [doi>10.1145/1015040.1015044]
• 18: Hess, A., Jacobson, J., Mills, H., Wamsley, R., Seamons, K. E., and Smith, B. 2002. Advanced client/server authentication in TLS. In Proceedings of the Network and Distributed Systems Security Symposium. 203--214.
• 19: Jason E. Holt , Robert W. Bradshaw , Kent E. Seamons , Hilarie Orman, Hidden Credentials, Proceedings of the 2003 ACM workshop on Privacy in the electronic society, October 30, 2003, Washington, DC [doi>10.1145/1005140.1005142]
• 20: ISRL. 2005. Internet security research lab--projects. ⟨http://isrl.cs.byu.edu/TrustBuilder.html⟩.
• 21: Koshutanski, H. and Massacci, F. 2004a. Interactive access control for web services. In Proceedings of the 19th IFIP Information Security Conference (SEC). 151--166.
• 22: Koshutanski, H. and Massacci, F. 2004b. Interactive trust management and negotiation scheme. In Proceedings of the Second International Workshop on Formal Aspects in Security and Trust (FAST). 139--152.
• 23: Koshutanski, H. and Massacci, F. 2005. Interactive credential negotiation for stateful business processes. In Proceedings of the 3rd International Conference on Trust Management (iTrust). 257--273.
• 24: Lee, A. J. and Winslett, M. 2006. Virtual fingerprinting as a foundation for reputation in open systems. In Proceedings of the 4th International Conference on Trust Management (iTrust'06). Number 3986 in Lecture Notes in Computer Science. Springer, 236--251.
• 25: Jiangtao Li , Ninghui Li , William H. Winsborough, Automated trust negotiation using cryptographic credentials, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102129]
• 26: Ninghui Li , Wenliang Du , Dan Boneh, Oblivious signature-based envelope, Proceedings of the twenty-second annual symposium on Principles of distributed computing, p.182-189, July 13-16, 2003, Boston, Massachusetts [doi>10.1145/872035.872061]
• 27: Li, N. and Mitchell, J. C. 2003. RT: A role-based trust-management framework. In Proceedings of the 3rd DARPA Information Survivability Conference and Exposition. 201--212.
• 28: Ninghui Li , William H. Winsborough , John C. Mitchell, Distributed credential chain discovery in trust management, Journal of Computer Security, v.11 n.1, p.35-86, February 2003
• 29: Kazuhiro Minami , David Kotz, Secure context-sensitive authorization, Pervasive and Mobile Computing, v.1 n.1, p.123-156, March 2005 [doi>10.1016/j.pmcj.2005.01.004]
• 30: Minami, K. and Kotz, D. 2006. Scalability in a secure distributed proof system. In Proceedings of the International Conference on Pervasive Computing. 220--237.
• 31: R. Moats, URN Syntax, RFC Editor, 1997
• 32: James H. Morris , Mahadev Satyanarayanan , Michael H. Conner , John H. Howard , David S. Rosenthal , F. Donelson Smith, Andrew: a distributed personal computing environment, Communications of the ACM, v.29 n.3, p.184-201, March 1986 [doi>10.1145/5666.5671]
• 33: Jason Novotny , Steven Tuecke , Von Welch, An Online Credential Repository for the Grid: MyProxy, Proceedings of the 10th IEEE International Symposium on High Performance Distributed Computing, p.104, August 07-09, 2001
• 34: Adam J. O'Donnell , Harish Sethu, On achieving software diversity for improved network security using distributed coloring algorithms, Proceedings of the 11th ACM conference on Computer and communications security, October 25-29, 2004, Washington DC, USA [doi>10.1145/1030083.1030101]
• 35: L. Pearlman , V. Welch , I. Foster , C. Kesselman , S. Tuecke, A Community Authorization Service for Group Collaboration, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.50, June 05-07, 2002
• 36: J. Postel , J. K. Reynolds, File Transfer Protocol, RFC Editor, 1985
• 37: Tatyana Ryutov , Li Zhou , Clifford Neuman , Travis Leithead , Kent E. Seamons, Adaptive trust negotiation and access control, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden [doi>10.1145/1063979.1064004]
• 38: Sahai, A. and Waters, B. 2005. Fuzzy identity based encryption. In Proceedings of Eurocrypt. Lecture Notes in Computer Science, vol. 3494, Springer, 457--473.
• 39: Saltzer, J. H. and Schroeder, M. D. 1975. The protection of information in computer systems. In Proceedings of IEEE 63, 9 (Sept.) 1278--1308.
• 40: Adi Shamir, How to share a secret, Communications of the ACM, v.22 n.11, p.612-613, Nov. 1979 [doi>10.1145/359168.359176]
• 41: Tuecke, S., Welch, V., Engert, D., Pearlman, L., and Thompson, M. 2004. Internet X.509 public key infrastructure (PKI) proxy certificate profile. IETF Request for Comments RFC-3820.
• 42: Lingyu Wang , Duminda Wijesekera , Sushil Jajodia, A logic-based framework for attribute based access control, Proceedings of the 2004 ACM workshop on Formal methods in security engineering, October 29-29, 2004, Washington DC, USA [doi>10.1145/1029133.1029140]
• 43: Von Welch , Frank Siebenlist , Ian Foster , John Bresnahan , Karl Czajkowski , Jarek Gawor , Carl Kesselman , Sam Meder , Laura Pearlman , Steven Tuecke, Security for Grid Services, Proceedings of the 12th IEEE International Symposium on High Performance Distributed Computing, p.48, June 22-24, 2003
• 44: N. Li , W. Winsborough, Towards Practical Automated Trust Negotiation, Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02), p.92, June 05-07, 2002
• 45: Winsborough, W. H., Seamons, K. E., and Jones, V. E. 2000. Automated trust negotiation. In Proceedings of the DARPA Information Survivability Conference and Exposition. 88--102.
• 46: Marianne Winslett , Ting Yu , Kent E. Seamons , Adam Hess , Jared Jacobson , Ryan Jarvis , Bryan Smith , Lina Yu, Negotiating Trust on the Web, IEEE Internet Computing, v.6 n.6, p.30-37, November 2002 [doi>10.1109/MIC.2002.1067734]
• 47: Marianne Winslett , Charles C. Zhang , Piero A. Bonatti, PeerAccess: a logic for distributed authorization, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102144]
• 48: Ylonen, T. and Lonvick, C. 2005. SSH transport layer protocol. IETF Network Working Group Internet-Draft.
• 49: Ting Yu , Marianne Winslett , Kent E. Seamons, Supporting structured credentials and sensitive policies through interoperable strategies for automated trust negotiation, ACM Transactions on Information and System Security (TISSEC), v.6 n.1, p.1-42, February 2003 [doi>10.1145/605434.605435]
• 50: Yongguang Zhang , Harrick Vin , Lorenzo Alvisi , Wenke Lee , Son K. Dao, Heterogeneous networking: a new survivability paradigm, Proceedings of the 2001 workshop on New security paradigms, September 10-13, 2001, Cloudcroft, New Mexico [doi>10.1145/508171.508177]

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.3 Network Operations

  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Management, Security

Keywords:
Attribute-based access control, credentials, trust negotiation