Decentralized trust management

TLDR

Trust management is a distinct security component in network services, involving policy formulation, credential evaluation, and delegation, yet existing systems like X.509 and PGP only address limited aspects for specific applications. This work proposes a comprehensive trust management framework that uses a simple language to specify trusted actions and relationships. The authors implement this framework in a prototype system called PolicyMaker, which supports building security features across diverse network services.

Abstract

We identify the trust management problem as a distinct and important component of security in network services. Aspects of the trust management problem include formulating security policies and security credentials, determining whether particular sets of credentials satisfy the relevant policies, and deferring trust to third parties. Existing systems that support security in networked applications, including X.509 and PGP, address only narrow subsets of the overall trust management problem and often do so in a manner that is appropriate to only one application. This paper presents a comprehensive approach to trust management, based on a simple language for specifying trusted actions and trust relationships. It also describes a prototype implementation of a new trust management system, called PolicyMaker, that will facilitate the development of security features in a wide range of network services.