Distributed Trust Management (TU/e)

Semester 1.

Course code: 2IS25

Time: on Tuesdays hours 5 and 6

Place: auditorium 14

OWInfo: href="https://venus.tue.nl/owinfo-cgi/owi_0695.opl?vakcode=2IS25&studiejaar=2009

The slides (are being updated during the course).

Note Please take 5 minutes to complete the questionnaire in https://svn.win.tue.nl/viewvc/security_public/teaching/dtm/ (see the word document), we need your input to evaluate the use of virtual lecture rooms. TU/e students can hand in their answers during the last lecture. UT students can send their answers to s.etalle@tue.nl.

Program

Blok A.
1. (Sept 1) Introduction. Jerry den Hartog.
   • Carl E. Landwehr. Formal models for computer security. ACM Computing Surveys 13(3): 247-278. (September 1981)
   • Matt Blaze, Joan Feigenbaum, and Jack Lacy. Decentralized Trust Management. Proceedings of the 1996 IEEE Symposium on Security and Privacy. 1996.
2. (Sept 8) Discretionary Access Control and safety problem. Sandro Etalle.
   • Butler W. Lampson. Protection. ACM SIGOPS Operating Systems Review 8(1): 18-24 (January 1974)
   • Michael A. Harrison, Walter L. Ruzzo, and Jeffrey D. Ullman. Protection in Operating Systems. Communications of the ACM 19(8): 461-471 (August 1976)
   • (optional) Ninghui Li, William H. Winsborough, John C. Mitchell. Beyond Proof-of-compliance: Safety and Availability Analysis in Trust Management. Proceedings of the 2003 IEEE Symposium on Security and Privacy. 2003 (only sections 1,2 and 5).
3. (Sept 15) Mandatory Access Control. Daniel Trivellato.
   • Ravi S. Sandhu. Lattice-Based Access Control Models Computer 26(11):9-19. (November 1993)
   • Carl E. Landwehr. Formal Models for Computer Security ACM Computing Surveys 13(3): 247-278. 1981.
   • Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
   • (optional) Ross Anderson Security Engineering (2nd Edition)
4. (Sept 22) Biba Model, Chinese wall, Separation of Duty. Daniel Trivellato.
5. (Sept 29) Role Based Access Control. Fred Spiessens.
   • Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, Charles E. Youman. Role-Based Access Control Models. Computer 29(2): 38-47, 1996
6. (Oct 13) Role-Based Trust Management I. Sandro Etalle.
   • Ninghui Li, John C. Mitchell, William H. Winsborough. Design of a Role-Based Trust-Management Framework.
   • Czenko, M.R. and Etalle, S. and Li, D. and Winsborough, W.H. (2007) An Introduction to the Role Based Trust Management Framework RT.
7. (Oct 20) Role-Based Trust Management II. Sandro Etalle.
   • Ninghui Li, William H. Winsborough, John C. Mitchell Distributed Credential Chain Discovery in Trust Management. (the type system and the forward and backward algorithms)
   • (Suggested) Marianne Winslett. An Introduction to Trust Negotiation.
Blok B.
8. (Nov 10) Role-Based Trust Management III. Sandro Etalle.
   • (not the algorithm, just the language and the examples) Czenko, M.R. and Tran, H.M. and Doumen, J.M. and Etalle, S. and Hartel, P.H. and den Hartog, J.I. (2005) Nonmonotonic Trust Management for P2P Applications. http://eprints.eemcs.utwente.nl/5738/
   • (again, not the algorithm, just the language and the examples) Etalle, S. and Winsborough, W.H. (2005) Integrity Constraints in Trust Management (Extended Abstract). In: 10th ACM Symp. on Access Control Models and Technologies (SACMAT), Stockholm, Sweden. pp. 1-10. ACM Press. http://eprints.eemcs.utwente.nl/698/
9. (Nov 17) Privacy and Data Protection: Introduction. Nicola Zannone.
   • P. Guarda and N. Zannone. Towards the Development of Privacy-Aware Systems. Information and Software Technology. 51(2):337-350. 2009.
10. (Nov 24) Privacy and Data Protection: Languages. Nicola Zannone.
    • eXtensible Access Control Markup Language (XACML) version 2.0
11. (Dec 1) Information Flow Policies: Theory. Bruno Pontes Soares Rocha.
    • Language-Based Information-Flow Security Andrei Sabelfeld and Andrew C. Myers. IEEE Journal on Selected Areas in Communications, 21(1):5--19, 2003.
    • The Jif compiler. (go to the "reference manual")
    • (suggested) Dimensions and Principles of Declassification. Andrei Sabelfeld and David Sands. Proceedings of the 18th IEEE workshop on Computer Security Foundations, pages 255--269, 2005.
12. (Dec 8) Information Flow Policies: Exercises. Bruno Pontes Soares Rocha.
13. (Dec 15) Application of Distributed Trust Management. Milan Petkovic.
14. (Jan 5) Reputation Systems. Nicola Zannone.
    • M. T. Schlosser, S. D. Kamvar, and H. Garcia-Molina. The EigenTrust Algorithm for Reputation Management in P2P Networks. In Proceedings of the Twelfth International World Wide Web Conference, 2003.
    • Audun Josang, Roslan Ismail, Colin Boyd. A survey of trust and reputation systems for online service provision. Decision Support Systems, Vol. 43, No. 2. (March 2007), pp. 618-644.
    • K. Hoffman, D. Zage, and C. Nita-Rotaru. A survey of attack and defense techniques for reputation systems. Technical Report CSD TR #07-013, Purdue University, 2007.
15. (Jan 12) Summary. Sandro Etalle.