Talk given at GC 2004: MyThS/MIKADO/DART Meeting, Venice 16.06.0

Sassone, V.

English

Southampton (e-Prints Soton)

WhyA Calculus for Trust ManagementVladimiro SassoneUniversity of Sussex, UKGC 2004: MyThS/MIKADO/DART MeetingVenice 16.06.04with M. Carbone and M. NielsenV. Sassone CTMWhyTrust and Trust ManagementTrust: What is it?Think of the usual human-like notion......but on a global computing scale.Trust Management: Fundamental aspects?1 Trust is gathered by individuals from personal experiences;2 Trust is shared by communities, e.g. to form “reputation systems”;Which means:Principals act according to “policies” upon consulting “trusttables,” and “update” these constantly according to theoutcome of transactions.V. Sassone CTMWhyTrust and Trust ManagementTrust: What is it?Think of the usual human-like notion......but on a global computing scale.Trust Management: Fundamental aspects?1 Trust is gathered by individuals from personal experiences;2 Trust is shared by communities, e.g. to form “reputation systems”;Which means:Principals act according to “policies” upon consulting “trusttables,” and “update” these constantly according to theoutcome of transactions.V. Sassone CTMWhyTrust and Trust ManagementTrust: What is it?Think of the usual human-like notion......but on a global computing scale.Trust Management: Fundamental aspects?1 Trust is gathered by individuals from personal experiences;2 Trust is shared by communities, e.g. to form “reputation systems”;Which means:Principals act according to “policies” upon consulting “trusttables,” and “update” these constantly according to theoutcome of transactions.V. Sassone CTMWhyTrust and Trust ManagementTrust: What is it?Think of the usual human-like notion......but on a global computing scale.Trust Management: Fundamental aspects?1 Trust is gathered by individuals from personal experiences;2 Trust is shared by communities, e.g. to form “reputation systems”;Which means:Principals act according to “policies” upon consulting “trusttables,” and “update” these constantly according to theoutcome of transactions.V. Sassone CTMWhyThe Frameworka{ P }α | NIt consists of:The Principal’s nameThe Principal’s programThe Principal’s policyThe rest of the networkφ :: b · chni: if a can prove φ according to α, it will grant n to balong c. E.g.x · print(y).Access(x,ColorPrinter) :: colPr · printhyib · c(y).P: Receive y from b along c, and record theobservation in policy α.V. Sassone CTMWhyThe Frameworka{ P }α | NIt consists of:The Principal’s nameThe Principal’s programThe Principal’s policyThe rest of the networkφ :: b · chni: if a can prove φ according to α, it will grant n to balong c. E.g.x · print(y).Access(x,ColorPrinter) :: colPr · printhyib · c(y).P: Receive y from b along c, and record theobservation in policy α.V. Sassone CTMWhyThe Frameworka{ P }α | NIt consists of:The Principal’s nameThe Principal’s programThe Principal’s policyThe rest of the networkφ :: b · chni: if a can prove φ according to α, it will grant n to balong c. E.g.x · print(y).Access(x,ColorPrinter) :: colPr · printhyib · c(y).P: Receive y from b along c, and record theobservation in policy α.V. Sassone CTMWhyThe Interaction RuleInteractionβ ` φ α0 = α upd(b · c B ˜ m) b : ˜ m match p : ˜ x = σa{ p · c(˜ x).P }α | b{ φ :: a · ch ˜ mi.Q }β → a{ Pσ }α0 | b{ Q }βV. Sassone CTMWhyThe logicVal = P + N.Val = P × Val+: observations (p,ch,mess).DeﬁnitionFix a signature Σ augmented with:constants Val;upd : s × Val → s (s distinguished sort).DeﬁnitionA message structure S,Op is a term algebra for the Σ above. Let Rbe a set of predicate symbols.Let π be a set of Horn clauses L ← L1,...Lk over such S and R.Principal’s policies α is of the form (π,#), for # ∈ S.V. Sassone CTMWhyThe calculusDeﬁnitionN,M ::=  (empty) P,Q ::= 0 (null)| N | N (net-par) | Z (sub)| a{ P }α (principal) | P | P (par)|| (νn) N (new-net) | (νn) P (new)| !P (bang)Z ::= p · u(˜ v).P (output)| φ :: p · uh˜ vi.P (input) φ ::= L(˜ l) L ∈ P (null)| Z + Z (sum)V. Sassone CTMWhyExample: A print serverBasic predicate Access(x,y), for x a principal and y ∈ {Color,BW}.Site policy π : { x · − B junk < 3 → Access(x,Color),x · − B junk < 6 → Access(x,BW)}where x · − B junk counts the occurrences of junk messages.Let a, the print server, and b be principals with resp. protocols:P =!x · printCol(y).Access(x,Color) :: printer · printColhyi |!x · printBW(y).Access(x,BW) :: printer · printBWhyiQ = a · printColhjunki.a · printBWhjunki.a · printColhjunki| a · printColhdociConsider N = a{ P }(π,∅) | b{ Q }α.V. Sassone CTMWhyExample: A print serverBasic predicate Access(x,y), for x a principal and y ∈ {Color,BW}.Site policy π : { x · − B junk < 3 → Access(x,Color),x · − B junk < 6 → Access(x,BW)}where x · − B junk counts the occurrences of junk messages.Let a, the print server, and b be principals with resp. protocols:P =!x · printCol(y).Access(x,Color) :: printer · printColhyi |!x · printBW(y).Access(x,BW) :: printer · printBWhyiQ = a · printColhjunki.a · printBWhjunki.a · printColhjunki| a · printColhdociConsider N = a{ P }(π,∅) | b{ Q }α.V. Sassone CTMWhyExample: A print serverBasic predicate Access(x,y), for x a principal and y ∈ {Color,BW}.Site policy π : { x · − B junk < 3 → Access(x,Color),x · − B junk < 6 → Access(x,BW)}where x · − B junk counts the occurrences of junk messages.Let a, the print server, and b be principals with resp. protocols:P =!x · printCol(y).Access(x,Color) :: printer · printColhyi |!x · printBW(y).Access(x,BW) :: printer · printBWhyiQ = a · printColhjunki.a · printBWhjunki.a · printColhjunki| a · printColhdociConsider N = a{ P }(π,∅) | b{ Q }α.V. Sassone CTMWhyExample: A bank recommendation systemInterpret messages as recommendations.Assume message structure is list of last k recommendations for eachuser. Let’s consider the protocolP = !x · mg(y).Grant(x,y) :: x · mghi.x · pay(y) |!ITAbank · rec(x,y)Policy for principal UKBank:π = {ITAbank · rec B (x,Bad) + x · pay B no = 0 → Grant(x,y)}which checks if the sum of messages from ITAbank of type (x,Bad)and from x of type no is zero.Mortgage allowed whenever there is not bad observed or badrecommended behaviour.V. Sassone CTMWhyResultsA nice cluster of bisimulations I don’t have time to tell you about.V. Sassone CTM

A Calculus for Trust Management (talk)

Abstract

Similar works

Full text

Available Versions

Southampton (e-Prints Soton)