[Paper Review] Declarative Reconfigurable Trust Management

William R. Marczak, David Zook+3 more|ArXiv.org|Sep 9, 2009

Access Control and Trust15 references3 citations

TL;DR

This paper introduces LBTrust, a declarative, reconfigurable trust management system built on LogicBlox’s Datalog-based platform, enabling customizable cryptographic, partitioning, and distribution strategies through meta-programming and meta-constraints. It unifies multiple trust management models (Binder, D1LP, Secure Network Datalog) and demonstrates feasibility via a prototype implementation with performance evaluation on a Binder-based system.

ABSTRACT

In recent years, there has been a proliferation of declarative logic-based trust management languages and systems proposed to ease the description, configuration, and enforcement of security policies. These systems have different tradeoffs in expressiveness and complexity, depending on the security constructs (e.g. authentication, delegation, secrecy, etc.) that are supported, and the assumed trust level and scale of the execution environment. In this paper, we present LBTrust, a unified declarative system for reconfigurable trust management, where various security constructs can be customized and composed in a declarative fashion. We present an initial proof-of-concept implementation of LBTrust using LogicBlox, an emerging commercial Datalog-based platform for enterprise software systems. The LogicBlox language enhances Datalog in a variety of ways, including constraints and meta-programming, as well as support for programmer defined constraints which on the meta-model itself ? meta-constraints ? which act to restrict the set of allowable programs. LBTrust utilizes LogicBlox?s meta-programming and meta-constraints to enable customizable cryptographic, partitioning and distribution strategies based on the execution environment. We present uses cases of LBTrust based on three trust management systems (Binder, D1LP, and Secure Network Datalog), and provide a preliminary evaluation of a Binder-based trust management system.

Motivation & Objective

• To address the growing complexity and heterogeneity of trust management systems by unifying diverse security constructs in a single framework.
• To enable runtime reconfiguration of trust policies based on execution environment characteristics such as trust level, scale, and deployment constraints.
• To support customizable cryptographic, partitioning, and distribution strategies through declarative configuration.
• To integrate multiple existing trust management systems (Binder, D1LP, Secure Network Datalog) into a unified, composable framework.
• To demonstrate feasibility and performance of the approach via a prototype implementation and evaluation on a Binder-based system.

Proposed method

• LBTrust is implemented using LogicBlox, a Datalog-based platform with support for meta-programming and meta-constraints.
• Meta-constraints are used to restrict the set of allowable programs, ensuring consistency and correctness of trust policy configurations.
• Declarative specification of trust policies allows for dynamic composition and customization of security constructs like authentication, delegation, and secrecy.
• The system leverages LogicBlox’s constraints and programmer-defined meta-models to enable runtime reconfiguration of trust strategies.
• A proof-of-concept prototype is built using the Binder trust management system as a base, extended with LBTrust’s reconfigurable capabilities.
• The approach supports modular integration of existing trust management systems by mapping their constructs into the LBTrust framework.

Experimental results

Research questions

• RQ1 How can a unified, declarative framework be designed to support diverse trust management constructs such as delegation, authentication, and secrecy?
• RQ2 What mechanisms enable runtime reconfiguration of trust policies based on execution environment characteristics?
• RQ3 How can meta-programming and meta-constraints in a Datalog-based system be used to enforce policy consistency and customization?
• RQ4 To what extent can existing trust management systems be composed and extended within a single declarative framework?
• RQ5 What performance and expressiveness trade-offs arise when unifying multiple trust management models in one system?

Key findings

• LBTrust successfully unifies three distinct trust management systems—Binder, D1LP, and Secure Network Datalog—into a single, composable framework.
• The use of meta-constraints in LogicBlox enables safe and consistent reconfiguration of trust policies without violating system invariants.
• The prototype implementation demonstrates that reconfigurable trust policies can be expressed and enforced using declarative logic with minimal performance overhead.
• The system supports dynamic adaptation of cryptographic and distribution strategies based on environmental trust levels and scale.
• A preliminary evaluation of the Binder-based implementation shows that LBTrust maintains acceptable performance while enabling complex, customizable trust policies.
• The integration of meta-programming capabilities allows for extensibility and runtime modification of trust policy logic without recompilation.