Obligations of Trust for Privacy and Confidentiality in Distributed Transactions

Mbanaso, U.M. and Cooper, G.S. and Chadwick, D.W. and Anderson, Anne (2009) Obligations of Trust for Privacy and Confidentiality in Distributed Transactions. Internet Research, 19 (2). pp. 182-196. (The full text of this publication is not available from this repository)

The full text of this publication is not available from this repository. (Contact us about this Publication)
Official URL
http://www.cs.kent.ac.uk/pubs/2009/3025

Abstract

Purpose This paper describes a bilateral symmetric approach to authorization, privacy protection and obligation enforcement in distributed transactions. We introduce the concept of the Obligation of Trust (OoT) protocol as a privacy assurance and authorization mechanism that is built upon the XACML standard. The OoT allows two communicating parties to dynamically exchange their privacy and authorization requirements and capabilities, which we term a Notification of Obligation (NoB), as well as their commitments to fulfilling each others requirements, which we term Signed Acceptance of Obligations (SAO). We describe some applicability of these concepts and show how they can be integrated into distributed authorization systems for stricter privacy and confidentiality control. Design/Methodology/Approach Existing access control and privacy protection systems are typically unilateral and provider-centric, in that the enterprise service provider assigns the access rights, makes the access control decisions, and determines the privacy policy. There is no negotiation between the client and the service provider about which access control or privacy policy to use. We adopt a symmetric, more user-centric approach to privacy protection and authorization, which treats the client and service provider as peers, in which both can stipulate their requirements and capabilities, and hence negotiate terms which are equally acceptable to both parties. Findings We demonstrate how the Obligation of Trust protocol can be used in a number of different scenarios to improve upon the mechanisms that are currently available today. Practical Implications This approach will serve to increase trust in distributed transactions since each communicating party receives a difficult to repudiate digitally signed Acceptance of Obligations, in a standard language (XACML), which can be automatically enforced by their respective computing machinery. Originality/Value This paper adds to current research in trust negotiation, privacy protection and authorization by combining all three together into one set of standardized protocols. Furthermore, by providing hard to repudiate Signed Acceptance of Obligations messages, this strengthens the legal case of the injured party should a dispute arise.

Item Type: Article
Uncontrolled keywords: XACML, trust, privacy, obligations, trust negotiation, SAML, authorization
Subjects: Q Science > QA Mathematics (inc Computing science) > QA 76 Software, computer programming,
Divisions: Faculties > Science Technology and Medical Studies > School of Computing > Security Group
Depositing User: David Chadwick
Date Deposited: 21 Sep 2012 09:49
Last Modified: 25 Oct 2012 18:42
Resource URI: http://kar.kent.ac.uk/id/eprint/30610 (The current URI for this page, for reference purposes)
  • Depositors only (login required):