Flexible Regulation of Virtual Enterprises Naftaly Minsky Rutgers University Joint work with Xuhui Ao

2 N. Minsky: DIMACS, e-commerce May05 Outline  The challenges to access control posed by e-commerce.  Regulation of virtual enterprises — a case study.  The law-governed interaction (LGI) mechanism, and how it meets the challenges to access control.  Conclusion

3 N. Minsky: DIMACS, e-commerce May05 The Challenges to AC  The distributed and open nature of E-commerce, and its scale.  PKI facilitates scalability;  but enforcement of AC policies is still done largely in a centralized fashion, making it hard to scale.  The need for more sophisticated policies, e.g.,  Stateful policies, sensitive to the history of interaction, like budgetary control.  Policies that mandate extra actions, like state change, or auditing.

4 N. Minsky: DIMACS, e-commerce May05 The Challenges to AC (cont)  The need for communal (rather than “server- centric”) policies, such as:  An enterprise-wide policy governing a set of servers.  Decentralized electronic marketplace.  B2B commerce, and supply chains.  The need for interoperation between different policies, and for hierarchical organization of policies.  All these challenges need to be met via a single scalable mechanism—for specifying policies, and for enforcing them.

5 N. Minsky: DIMACS, e-commerce May05 Governance of Virtual Enterprise (a Case Study)  Consider a coalition C of enterprises {E 1,..., E n }, governed by a coalition-policy P C ---where each E i is governed by its own internal-policy P i.  As in: virtual enterprises, supply chains, grid computing, etc. E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

6 N. Minsky: DIMACS, e-commerce May05 Policies Governing a Virtual Enterprise (an Example) E2E2 E3E3 E1E1 Roles: each Ei should have its director Di( * ); and the coalition C a director D C. A director Di can mint Ei-currency $ i needed to pay for services provided by Ei and it can give D C some of this currency A director D C can distribute some of its $ i currency among other directors. $1$1 $1$1 Servers at E1 can send their earning in $ 1 back to their director PCPC P2P2 P1P1 $1$1 $1$1 $1$1 $ i Currency cannot be forged—by anyone! A director D 2 can distribute its $ i budget among agents at its enterprise $1$1 $1$1

7 N. Minsky: DIMACS, e-commerce May05 The Main Challenges  The flexible formulation of such policies, so that:  they will be consistent, and  their specification and evolution would be manageable.  Enforcement of such policies, and in a scalable manner.

8 N. Minsky: DIMACS, e-commerce May05 The Compositions Approach…  Given the set {P C, P 1,..., P n } of policies.  Construct a set composed policies: {P i,j = composition (P i, P C, P j )}  Provide these compositions to the reference monitor (RM) that mediates all coalition- relevant interactions.  Compositions were studied by: Gong & Qian 96, and by Bidan & Issarny 98,...

9 N. Minsky: DIMACS, e-commerce May05 … and its Problematics  It is unlikely for arbitrary, and independently formulated, policies to be consistent—so such composition is likely to fail.  Policy composition is computationally intractable (McDaniel & Prakash 2002)—and, we need N^2 such compositions!  Inflexibility: consider changing a single P i...

10 N. Minsky: DIMACS, e-commerce May05 The Proposed Approach  Instead of creating N^2 compositions (P i, P C, P j ), we will enable each enterprise E i to create it own policy P i, subject only to the constraint that P i would conform to P C.  We will then allow E i and E j to interoperate, each enforcing its own policy, P i & P j respectively  We will do this via the control mechanism called law-governed interaction (LGI).

11 N. Minsky: DIMACS, e-commerce May05 Law-Governed Interaction (LGI) (main characteristics)  LGI is an access-control and coordination mechanism  LGI is communal: can impose mandatory policies (called “laws”) over an entire community.  Enforcement is decentralized for scalability (actually, supports a whole spectrum of decentralization).  Supports a wide range of laws including those that mandate extra actions, in a stateful manner.  Supports hierarchy and interoperability.  Efficient (overhead of about 0.1 ms), and incremental.  Due to be released this summer.

12 N. Minsky: DIMACS, e-commerce May05 Centralized Enforcement of Communal Policies * The problems: potential congestion, and single point of failure m’ x u v y m ==> y m ==> x m Legend: P---Explicit statement of a policy. I---Policy interpreter S---the interaction state of the community P I S Reference monitor * Replication does not help, if S changes rapidly enough

13 N. Minsky: DIMACS, e-commerce May05 Distributed Law-Enforcement under LGI L I S x u v y L I SxSx L I SvSv L I SySy L I SuSu m ==> y m’ m’’ m m ==> y m

14 N. Minsky: DIMACS, e-commerce May05 Deployment of LGI via a Distributed TCB (DTCB) I I I I IIx y controller server m’ adopt(L, name) L m’’ adopt(L, name) L m ==> y

15 N. Minsky: DIMACS, e-commerce May05 On the basis for trust between members of a community  For a pair of interlocutors to trust each other to comply with the same law, one needs to ensure:  that the exchange of messages is mediated by correctly implemented controllers.  that interacting controllers operate under the same law L.  Such assurances are provided, basically, via certification of controllers, and the exchange of the hash of the law. xy L I CS x L I CS y m ==> y m’’ [m’,hash(L)] C x CxCx CyCy

Hierarchy Organization of Coalition Policies (back to the case study) PCPC P1P1 P2P2 PnPn superiorsubordinate P i is defined as subordinate to P c, as thus constrained to conform to it.

17 N. Minsky: DIMACS, e-commerce May05 Interoperability  Let us focus on the interoperability between E 2 and E 1 E3E3 E2E2 E1E1 P2P2 P1P1 P3P3 PCPC

18 N. Minsky: DIMACS, e-commerce May05 Interoperability (cont.) imported(x,P 2,m) E2E2 E1E1 x y Authenticated by CA 2 and CA C Authenticated by CA 1 and CA C controller P1P1 P2P2 C x C y CS x II m export(m,y,P 1 )

19 N. Minsky: DIMACS, e-commerce May05 Conclusion  LGI implementation via the Moses middleware is to be released in May 2005, via:  This initial release would not support policy hierarchy.  For a complete treatment of the coalition problem, see: Flexible Regulation of Distributed Coalitions Ao and Minsky In Proc. of the 8th European Symposium on Research in Computer Security (ESORICS) October 2003.

Questions?

21 N. Minsky: DIMACS, e-commerce May05 Server-Centric Access-Control (AC) Reference Monitor (RM) server It generally supports only stateless, purely reactive, ACL-based policies, enhanced with RBAC—and this is far from sufficient.

22 N. Minsky: DIMACS, e-commerce May05 Enforcing a Communal AC Policy Enterprise-wide (communal) policy P Enterprise delegate The communal policy may be that certain type of transactions need to be monitores…