Trusted Computing Or Distributed Trust Management?
Total Page：16
File Type：pdf, Size：1020Kb
Trusted computing or distributed trust management? Michele Tomaiuolo Dipartimento di Ingegneria dell’Informazione Università di Parma Via Usberti, 181/A – 43100 Parma – Italy [email protected] Abstract Nowadays, in contrast with centralized or hierarchical certification authorities and directory of names, other solutions are gaining momentum. Federation of already deployed security systems is considered the key to build global security infrastructures. In this field, trust management systems can play an important role, being based on a totally distributed architecture. The idea of distributed trust management can be confronted with the concept of trusted computing. Though having a confusingly similar denomination, the different interpretation of trust in these systems drives to divergent consequences with respect to system architectures and access policies, but also to law, ethics, politics. While trusted computing systems assure copyright holders and media producers that the hosting system will respect the access restrictions they defined, trust management systems, instead, allow users to grant trust to other users or software agents for accessing local resources. Keywords Data security, Security Management, Authentication, Authorization, Intellectual Property Rights, Information Access, Digital Books, Multimedia, Web Technologies Introduction A number of architectures and systems are being proposed as a ground for improved interoperability among diverse systems, mainly exploiting the idea of service-oriented architecture. Yet, some issues remain open. In fact, composition of services requires some delegation of goals and duties among partners. But these delegations cannot come into effect, if they’re not associated with a corresponding delegation of privileges, needed to access some resources and complete delegated tasks, or achieve desired goals. The traditional approach for inter-domain security is based on centralized or hierarchical certification authorities and public directory of names. In contrast with this hierarchical approach, other solutions are possible, where the owner of local resources is considered as the ultimate source of trust about them, and he is provided with means to carefully administer the flow of delegated permissions. Trust management principles argue no a-priori trusted parties should be supposed to exist in the system, as this would imply some “obligated choice” of trust for the user, and without choice, there’s no real trust. Moreover, the presence of some third party as a globally trusted entity implies that all systems participating in the global environment have to equally trust it. Nowadays, new technologies, in the form of protocols and certificate representations, are gaining momentum. They allow a different approach toward security in global environments, an approach which paradoxically is founded on the concept of “locality”. Federation of already deployed security systems is considered the key to build global security infrastructures. This way, users are not obliged to adopt some out of the box solution for their particular security issues, to rebuild the whole system or to make it dependent upon some global authority, for gaining interoperability with others. Instead they’re provided with means to manage the trust relations they build with other entities operating in the same, global environment. In the same manner as people collaborate in the real world, systems are being made interoperable in the virtual world. Cooperation and agreements among companies and institutions are making virtual organizations both a reality and a necessity. But they’ll never spring into success if existing technologies will not match their needs. This chapter will deal with trust management in open and decentralized environments. Up-to- date technologies like SAML, OpenID, XRI, XDI, XACML, Web Services protocols and extensions, will be analysed from the perspective of peer to peer networks, intended not only as a technology, but above all as a web of trust relationships, where parties interoperate directly, without reliance on any centralized directory or authority. Securing access to the resources made available by the peers is a requirement to make peer to peer interoperation a more widespread paradigm. The secure management of trust relationships, the ability to precisely control the flow of delegated permissions to trusted entities, is a fundamental requirement to allow the composition of the more disparate services provided on the network. This chapter will also analyse the fundamental differences between decentralized trust management, on the one hand, and digital rights management and trusted computing, on the other hand. The different interpretation of trust in these systems drives to divergent consequences with respect to system architectures and access policies, but also to law, ethics, politics. While trusted systems assure copyright holders and media producers that the hosting system will respect the access restrictions they defined, trust management systems, instead, allow users to grant trust to other users or software agents for accessing local resources. The analysis will start from XrML and ODRL, two similar XML-based languages oriented to the management of digital rights for media content distribution. Both languages are oriented to the management of digital rights (DRM) for publishing and accessing media content, and can hardly fit different applications. In fact, these Rights Expression Languages resulted from efforts of businesses to protect digital material from reproduction and sharing. They just allow copyright owners to express restrictions about the usage of a resource, without being able to enforce by themselves the policies they convey. This can only happen on so-called “trusted systems”. Support for DRM is being included into a growing number of devices and systems. The international legal framework is also paying attention to DRM systems. Many nations adhering to the World Intellectual Property Organization (WIPO) are implementing the 1996 WIPO Copyright Treaty (WCT), which requires to enact laws against DRM circumvention. The 1998 Digital Millennium Copyright Act (DMCA) in the USA and the 2001 European directive on copyright (EUCD) are two important examples. Background Public-key cryptography is the basis for digital signature, and it is founded on public/private key pairs. The scalability of this technology is assured by the fact that only the private component of the public/private key pair must be protected, while the public component can be distributed on public networks, thus allowing interested parties to use security services. The idea itself is as old as the paper of Diffie and Hellman, which in 1976 described, for the first time, a public key cryptographic algorithm (Diffie, Hellman, 1976). Given a system of this kind, the problem of key distribution is vastly simplified. Each user generates a pair of inverse transformations, E and D, at his terminal. The deciphering transformation, D, must be kept secret, but in fact it does never need to be communicated on any channel. Instead the enciphering transformation, E, can be made public by placing it in a public directory along with the user’s name and address. Anyone can then encrypt messages and send them to the user; no one can decipher messages but their intended recipients. Before Diffie and Hellman published their algorithm, key distribution was a highly risky process. The revolutionary idea of public key cryptography was to greatly simplify this problem. But it was soon realized that, even if the public key can be distributed freely, some form of integrity must be assured to make it usable in security services. In fact, most security services require the public key to be associated with other information, and this binding must be protected. In particular, the user of the public key must be assured that: the public key, and the information associated to it, must be protected in its integrity against unnoticed tampering; the association between the public key and other information has been gathered in a trusted manner. In fact, a data integrity mechanism is not sufficient, by itself, to guarantee that the binding between the public key and its owner (or any other information associated to it) has been verified in a trustworthy manner. Moreover, any implemented protection scheme should not affect the scalability of the overall public-key infrastructure. These goals are at the basis of each public-key infrastructure, and in particular they inspired the X.509 infrastructure (Housley, Polk & al., 2002). Digital certificates were originally introduced to ensure the integrity of public keys, thus providing a scalable solution to the key distribution problem. Their primary function was to bind names to keys or keys to names. Before continuing, however, it’s worth spending some words about “digital certificates”. First of all, the expression itself is not very precise, as it could include paper certificates after being digitized. Also, it’s confusing, as it seems to suggest that security services can be enabled by presenting proper certificates. In reality, digital certificates, per se, don’t provide any security, but can be used together with digital signatures to provide some additional information about the message sender. In contrast, digital signatures have an intrinsic meaning, at least demonstrating that the message sender has access to a particular private key. The original idea of encapsulating