Risk management for distributed authorization

Article type: Research Article

Authors: Skalka, Christian^{; *} | Wang, X. Sean | Chapin, Peter

Affiliations: University of Vermont

Correspondence: [*] Corresonding author. Department of Computer Science, University of Vermont, Burlington, VT 05405, USA. Tel.: +1 802 656 1920; E-mail: [email protected]

Abstract: Distributed authorization takes into account several elements, including certificates that may be provided by non-local actors. While most trust management systems treat all assertions as equally valid up to certificate authentication, realistic considerations may associate risk with some of these elements, for example some actors may be less trusted than others. Furthermore, practical online authorization may require certain levels of risk to be tolerated. In this paper, we introduce a trust management logic based on the system RT that incorporates formal risk assessment. This formalization allows risk levels to be associated with authorization, and authorization risk thresholds to be precisely specified and enforced. We also develop an algorithm for automatic authorization in a distributed environment, that is directed by risk considerations. A variety of practical applications are discussed.

Keywords: Distributed authorization, trust management logic

DOI: 10.3233/JCS-2007-15402

Journal: Journal of Computer Security, vol. 15, no. 4, pp. 447-489, 2007