[Paper Review] SAFE: A Declarative Trust Management System with Linked Credentials

Vamsi Thummala, Jeffrey S. Chase|arXiv (Cornell University)|Oct 15, 2015

Access Control and Trust35 references3 citations

TL;DR

SAFE is a declarative trust management system that uses linked credentials and a shared key-value store to automate context assembly for trust decisions. By enabling secure, cached, and composable logic sets via set linking, SAFE simplifies credential discovery, revocation, and policy enforcement in federated, distributed systems, as demonstrated in real-world case studies like a DNSSec-like resolver and an IaaS authorization module.

ABSTRACT

We present SAFE, an integrated system for managing trust using a logic-based declarative language. Logical trust systems authorize each request by constructing a proof from a context---a set of authenticated logic statements representing credentials and policies issued by various principals in a networked system. A key barrier to practical use of logical trust systems is the problem of managing proof contexts: identifying, validating, and assembling the credentials and policies that are relevant to each trust decision. This paper describes a new approach to managing proof contexts using context linking and caching. Credentials and policies are stored as certified logic sets named by secure identifiers in a shared key-value store. SAFE offers language constructs to build and modify logic sets, link sets to form unions, pass them by reference, and add them to proof contexts. SAFE fetches and validates credential sets on demand and caches them in the authorizer. We evaluate and discuss our experience using SAFE to build secure services based on case studies drawn from practice: a secure name service resolver, a secure proxy shim for a key value store, and an authorization module for a networked infrastructure-as-a-service system with a federated trust structure.

Motivation & Objective

• To address the practical challenges of credential discovery, freshness, and usability in logic-based trust management systems.
• To enable scalable and efficient proof context construction in distributed, federated trust environments.
• To simplify trust policy authoring and integration with application logic through a scripting language (slang) and secure, named logic sets.
• To support efficient caching and reuse of credentials via a shared, secure key-value store (SafeSets).
• To demonstrate practical deployment of declarative trust logic in real-world systems like secure name resolution and IaaS authorization.

Proposed method

• Credentials and policies are stored as cryptographically signed logic sets (slogsets) named by secure identifiers in a shared, distributed key-value store called SafeSets.
• Set linking enables logical unions of credential sets, forming a graph of dependencies that are resolved on-demand during proof construction.
• The slang scripting language allows first-class manipulation of slogsets, including passing them by reference and composing linked contexts.
• Proof contexts are built transitively from linked sets, with caching at the authorizer to avoid redundant validation.
• Trust anchors and local policies are used to validate proofs, emulating certified validation similar to SD3.
• The system supports delegation and endorsement via datalog rules, with speaksFor used only for joint ownership or third-party attribution.

Experimental results

Research questions

• RQ1 How can proof contexts in logic-based trust systems be efficiently discovered and assembled in a distributed, federated environment?
• RQ2 What mechanisms enable scalable and secure credential sharing and caching without global name resolution?
• RQ3 How can declarative trust logic be made practical and composable for real-world service implementations?
• RQ4 Can set linking and shared storage reduce the overhead of credential validation and improve trust management performance?
• RQ5 How does the integration of a scripting language (slang) with a secure logic store enhance usability and policy expressiveness?

Key findings

• SAFE successfully implements a secure name service resolver (SafeNS) that emulates DNSSec, demonstrating end-to-end trust validation using linked credentials.
• The system supports efficient caching of credential sets at the authorizer, reducing redundant validation and improving performance.
• Set linking enables scalable credential discovery by organizing credentials into a graph of dependencies, avoiding the need for global certificate queries.
• The use of secure, public-key-based identifiers for logic sets ensures integrity and prevents forgery in the shared store (SafeSets).
• Case studies in a networked IaaS system and a secure proxy shim confirm that SAFE supports complex, real-world trust policies with minimal trust management complexity.
• The system demonstrates that declarative trust logic can be practically deployed when combined with scripting, linking, and shared storage, overcoming prior usability and scalability barriers.