Modeling Trust Management and Security of Information

Abstract

This paper is a survey of studies of modeling access control and trust management. Access control is an important requirement of information systems. Role Based Access Control (RBAC) is the most flexible type of access control policy. It is a model of access control in enterprise information systems. It uses a user role to control which users have access to given resources. Access rights are grouped by a role name, and access to resources is restricted to these users who are assigned to appropriate roles. Each user can be assigned to one or more roles, which itself can be associated with one or more privileges. Conventional access control models are suitable for regulating access to resources by recognized users. Unfortunately, these models have often been inadequate for decentralized and open systems where the identity of the users is not known and users are changing constantly. To overcome the shortcomings of conventional access control models, like RBAC, credential-based access control has been proposed. Credential-based systems implement a notion of binary trust. However, due to the monotonicity requirement, these models will be more appropriate for a theoretical analysis than for real use. Non monotonic Trust Management system for P2P applications is also described.