A security framework combining access control and

trust management for mobile e-commerce

applications

Gregor v.Bochmann, Zhen Zhang, Carlisle Adams

School of Information Technology and Engineering (SITE)

and Jennifer Chandler Faculty of Law

University of Ottawa

AbstractIn the context of e-commerce applications, access control must be combinedwith authentication and trust management. In this presentation, we considerseveral typical usage scenarios for mobile e-commerce users. We consider thesecurity requirements which include authentication, authorization, privacy,and risk management, and discuss how these requirements can be met withvarious access control and trust management models. We then present a securee-commerce framework including functions for authentication, role-based accesscontrol and trust management for clients as well as service providers. Thedistributed trust management system allows the client to choose the serviceprovider based on trust information, and the service provider may determinehis trust in the user before determining the access rights that will begranted; we note that this may raise certain privacy law issues.   Anexperimental implementation of this framework is then presented which is basedon our previous work [1,2,4] and incorporates the "XML Security Suite" fromIBM. The presentation will introduce the architecture of this securityframework, highlight some of the system components and discuss

implementationchoices and performance issues.

Overview Usage scenarios and security requirements Background studies

Home directory for mobile users Authentication for mobile users A trust model Combining trust and access control

Security and trust for mobile users System Implementation Conclusion

Typical Scenarios

Mobile users: in a foreign domain – using portable and ad hoc devices

I. VoIP ConversationBob starts audio/video conversation with Alice over Internet while he is in a hotel.

II. Secure PrintingBob needs to print sensitive documentations from a commercial site

III. Anonymous Online ServiceBob requests a online service from a hotel room without disclosing his identification to service provider

Security requirements

Data integrity Authentication Privacy, Anonymity Access control, Authorization Signatures with non-repudiation … and Trust …

Background study

Authentication for mobile users Enable support for mobile user and services: The

concept of home directory[1]

Background study

Authentication for mobile users Proposed authentication model for mobile users: A

secure authentication protocol for mobile users[2]

Background study

Transactions based on trust Existing access control model for mobile users:

Autonomic Distributed Authorization Middleware [3]

(Figure adapted from [3])

Background study

Trust model with statistical foundation

Proposed trust model for mobile users: A trust model with statistical foundation[4]

Decision

Inte

ract Summarize

ExperiencesUpdateR

ecom

men

datio

ns

VeryBad Bad Average Good Very Good Excellent

10%

20%

30%

QoS

Probability

Overview of proposed system (with typical scenario II)

Bob Home Domain Foreign Domain

Home AgentForeign Agent

Bob with his PDA

Reputation Server

PEP&PDP Service Server with Policy Store

Service DirectoryPrint@137.122.90.186:9090

While Bob is on a business trip in Paris, he wants to print his bank statement from a hotel’s business center of which he is staying at

Phase I: Authentication & Role Assignment

Additionally, Bob receive a set of Roles from F.A, each of which has the form of CERTFA( Rx, IDBob)

CERTFA(Role{R1, R2, R3,…})

At this point, Bob and F.A. share Ks2 while Bob and H.A. share Ks3.

Phase II: Service Selection

Service Directory Reputation Server

Search(Service)

Avail.(Service Candidates)

get(Service Reputation Data)

Data(Reputation of Service)

Req(Service)

Eva:(Service,Local Policy,Reputation(Service))

get(Client Reputation Data)

Data(Reputation of Client)

Eva(Client,Local Policy,Reputation(Client))

ACK(Req(Service))

Service ServerBob

Phase III:

Service Request & Access Control

Policy Store

Access to the Sevice

Service ServerBob PEP / PDP

Policies related to the Service

Policies(service)

evaluation according to the policies

Forward the access to service serverACK/NACK

Phase IV:

Service Reputation update

ACK/NACK:

Reputation Server

update(Bob' Reputation Data)

ACK/NACK: ACK/NACK

update(Sevice Reputation Data)

Service ServerBob

Implementation Environment Open wireless LAN Service Directory & Reputation Server:

well-known URL Use of XACL (XML-encoded)

Service request/response messages Access policy representation

Role assignment: based on trust Implementation:

Java (Sun JVM and Blackdown java on IPAQ)

IBM Security Suite (XACL support)

Implementation architecture

Bob Home Domain Foreign Domain

Home AgentForeign Agent

Bob with his PDA

Reputation Server

PEP&PDP Service Server with Policy Store

Service DirectoryPrint@137.122.90.186:9090

PC-1

PC-2

PC-3Ipaq

Conclusion Secure e-commerce framework for fixed

and mobile users authentication role-based access control trust management for clients as well as service

providers The general framework can be customized

to fit any particular service requirement Performance of a simplified system

implementation is still under investigation

Reference1. K. El-Khatib, Zhen E. Zhang, N. Hadibi, and G. v. Bochmann,

Personal and Service Mobility in Ubiquitous Computing Environments, Journal of Wireless communications and Mobile Computing, 2004

2. G. v. Bochmann and Zhen E. Zhang, A secure authentication infrastructure for mobile users, Advances in Security and Payment Methods for Mobile Commerce, 2004

3. A. Seleznyov, S. Hailes, An access control model based on distributed knowledge management, 18th International Conference on Advanced Information Networking and Applications, 2004.

4. Jianqiang Shi, G. v. Bochmann and Carlisle Adams, A trust model with statistical foundation, Workshop on Formal Aspects in Security and Trust (FAST '04), 18th IFIP World Computer Congress, 2004

Thank you!

Questions ?