Developing Pervasive Trust Paradigm for Authentication and Authorization

Trust plays a growing role in research on security in open computing systems, including Grid computing. We propose using trust for authorization in such systems. Traditionally, authentication and authorization in computer systems guard only user interfaces, thus providing only a perimeter defense against attacks. We search for an authentication and authorization approach that satisfies the requirements of defense in depth. After reviewing and classifying a variety of security paradigms, we propose the paradigm of Pervasive Trust. It is analogous to a social model of interaction, where trust is constantly —if often unconsciously— applied. In an initial study, we investigated using our trust paradigm as the solid conceptual basis for the perimeter-defense authorization solution developed in our lab: a trust-enhanced role-mapping server. The server improves role-based access control mechanisms by providing and managing trust ratings for users.