Trust Delegation Research Articles

Secure remittance transaction to bankless consumers in a fragmented applications market

This paper proposes a novel electronic monetary transaction scheme that provides secure access to a set of mobile payment services for “unbanked” consumers equipped with mobile handsets. It considers a realistic scenario of a remittance service, i.e., a user-to-user transfer of funds, in which users do not necessarily trust intermediate parties (called agents) or their infrastructures and therefore require end-to-end security and privacy protection. Since the payment solutions market is very fragmented, we also assume that users and agents are subscribed to different payment solution providers. The paper proposes a holistic approach to securing payment services by focusing on securing the transaction rather than requiring users to authenticate with unknown agent infrastructures and by using a mechanism of delegation of trust. It also proposes a novel security approach for securing payment transactions over insecure communication channels based on the Identity Based Authenticated Key Exchange (IBAKE).

Secure and efficient public key management in next generation mobile networks

Employing public key-based security architecture is inevitable for the advanced security applications in the mobile networks. However, key storage management problems have arisen, because the public key computation is still the large overhead to USIM, and the mobile equipment has potential threats of the key leakage or loss. In order to solve such shortcomings, we improve the key-insulated models and propose "Trust Delegation" model that the overall security computations are operated in ME, while the initial private key still remains in the secure storage in USIM. Our model is resilient against not only key exposure but also key loss. Finally, we show that the overall transactions can be reduced to one-third than current 3GPP Generic Authentication Architecture.

Collaborative service evaluation with the TwoHop trust framework

ABSTRACTThe TwoHop trust framework is a collaborative system for computing trust towards service providers in a peer‐to‐peer network. TwoHop participants share their trust information so that peers without prior interaction may establish indirect trust relationships. TwoHop imposes a limit of two hops on trust delegation chains, which allows for increased efficiency in the trust calculation process. In addition, it provides multiple edges between nodes in the trust graph, allowing for the existence of both service evaluations and recommendations for service evaluators. In this paper, we present an improved version of the TwoHop trust calculation algorithm along with a formal description of its model of trust. We evaluate its key characteristics against those of other trust frameworks and compare it with the EigenTrust algorithm and to an improved version of the PeerTrust algorithm in terms of performance. Our simulation results indicate the robustness of our design against dishonest participants and its ability to scale to accommodate the needs of large peer‐to‐peer networks. Copyright © 2011 John Wiley & Sons, Ltd.

Role Based Trust Delegation for P2P Network

Role Based Trust Delegation for P2P Network

Key aspects of the UNICORE 6 security model

This paper presents the security architecture of the sixth version of the UNICORE grid middleware. The sixth iteration of UNICORE introduced a number of new, security-related solutions which make UNICORE distinguishable from the other grid middleware as Globus, gLite or NorduGrid ARC, and these are presented in this paper. The paper discusses the low level security: users authentication, non-repudiation control and trust delegation. The UNICORE unique approach to the challenge of trust delegation is called explicit trust delegation (ETD); discussion of this constitutes the most significant and extensive part of this paper. ETD is compared with the popular grid security infrastructure (GSI). High level security services (such as authorization services) are not described in this paper.

Ordered Semiring-based Trust Establish Model with Risk Evaluating.

Distributed trust management supports the provision of the required levels in a flexible and scalable manner by locally discriminating between the entities with which a principal should interact. However, there is a tension between the preservation of privacy and the controlled re- lease of information when an entity submits credentials for establishing and verifying trust metric where it may disclose too much information of the credentials. Further- more, trust delegation will require some levels of risk to be tolerated. In this paper, we propose a trust model with privacy protecting and risk evaluating. Our model is based on an ordered semiring framework. In proposed ordered semiring framework, credential graph is flexible enough to express trust relationship which adapts to the trust and privacy risk aggregating and concentrating in decentralized network systems. We describe a solution model to establish trust with risk evaluating with the trust opinion and privacy opinion, and also provide the minimized privacy disclosure credential search algorithm based on ordered semiring model.

Editorial: A Special Issue from the Open Grid Forum

Editorial: A Special Issue from the Open Grid Forum

Heuristic Discovery of Role-Based Trust Chains in Peer-to-Peer Networks

Credential chains are needed in trusted peer-to-peer (P2P) applications, where trust delegation must be established between each pair of peers at specific role level. Role-based trust is refined from the coarse-grained trust model used in most P2P reputation systems. This paper offers a novel heuristic-weighting approach to selecting the most likely path to construct a role-based trust chain. We apply history-sensitive heuristics to measure the path complexity and assess the chaining efficiency. We discover successive edges of a trust chain, adaptively, to match with the demands from various P2P applications. New heuristic chaining algorithms are developed for backward, forward, and bi-directional discovery of trust chains. Our heuristic chain discovery scheme shortens the search time, reduces the memory requirement, and enhances the chaining accuracy in scalable P2P networks. Consider a trust graph over N credentials and M distinct role nodes. Our heuristic trust-chain discovery algorithms require O(N <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">log</i> N) search time and O(M) memory space, if the secondary heuristics are generated off-line in advance. These are improved from O(N <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">3</sup> ) search time and O(NM) space required in non-heuristic discovery algorithms by Li, Winsborough, and Mitchell (2003). Our analytical results are verified by extensive simulation experiments over typical classes of role-based trust graphs.

Fault‐tolerant execution of large parameter sweep applications across multiple VOs with storage constraints

AbstractApplications that span multiple virtual organizations (VOs) are of great interest to the e‐science community. However, our recent attempts to execute large‐scale parameter sweep applications (PSAs) for real‐world climate studies with the Nimrod/G tool have exposed problems in the areas of fault tolerance, data storage and trust management. In response, we have implemented a task‐splitting approach that facilitates breaking up large PSAs into a sequence of dependent subtasks, improving fault tolerance; provides a garbage collection technique that deletes unnecessary data; and employs a trust delegation technique that facilitates flexible third party data transfers across different VOs. Copyright © 2008 John Wiley &amp; Sons, Ltd.

An Efficient Mobile Authentication Scheme for Wireless Networks

This paper proposes an efficient authentication scheme, which is suitable for low-power mobile devices. It uses an elliptic-curve-eryptosystem based trust delegation mechanism to generate a delegation passcode for mobile station authentication, and it can effectively defend all known attacks to mobile networks including the denial-of-service attack. Moreover, the mobile station only needs to receive one message and send one message to authenticate itself to a visitor's location register, and the scheme only requires a single elliptic-curve scalar point multiplication on a mobile device. Therefore, this scheme enjoys both computation efficiency and communication efficiency as compared to known mobile authentication schemes.

Routing optimization security in mobile IPv6

Route Optimization (RO) in Mobile IPv6 (MIPv6) provides a mobile node (MN) the opportunity to eliminate the inefficient triangle routing with its corresponding node (CN) and therefore, greatly improves the network performance. However, in doing so, MIPv6 introduces several security vulnerabilities, and among them a major concern is the authentication and authorization of Binding Updates (BUs) during the RO process. Unauthenticated or malicious BUs open the door for many types of attacks. As every IPv6 node is expected to support MIPv6, mechanisms to secure BU will have a significant impact on the next generation Internet. In this paper, based on an in-depth analysis of the security weaknesses existing in previously proposed protocols, a light-weight BU protocol with high security strength is proposed, which makes use of public key certificate-based strong authentication technique. Another important contribution of the paper is the introduction of a novel and scalable 3-layer trust management framework, which takes advantage of IPv6 address format and home link’s jurisdiction over the addresses it assigns, and thereby solves the difficult certificate issuing and management problem presented in the previous public key certificate-based solutions via trust delegation. The proposed protocol is highly efficient in term of both computation and communication costs on both MN and CN sides. An extended protocol is also proposed to explicitly support Hierarchical MIPv6 (HMIPv6).

REFEREE: trust management for Web applications

Digital signatures provide a mechanism for guaranteeing integrity and authenticity of Web content but not more general notions of security or trust. Web-aware applications must permit users to state clearly their own security policies and, of course, must provide the cryptographic tools for manipulating digital signatures. This paper describes the REFEREE trust management system for Web applications; REFEREE provides both a general policy-evaluation mechanism for Web clients and servers and a language for specifying trust policies. REFEREE places all trust decisions under explicit policy control; in the REFEREE model, every action, including evaluation of compliance with policy, happens under the control of some policy. That is, REFEREE is a system for writing policies about policies, as well as policies about cryptographic keys, PICS label bureaus, certification authorities, trust delegation, or anything else. In this paper, we flesh out the need for trust management in Web applications, explain the design philosophy of the REFEREE trust management system, and describe a prototype implementation of REFEREE.