Subject: Re: (DVD to DVP ga fajii shisutemu desu ka?)

From: "Bob Jueneman" <[email-masked]>
Date: Mon, 22 Jan 2001 17:41:26 -0700

Back in 1989, I wrote a paper entitled "Integrity Controls for 
Military and Commercial Applications". as a contribution to an 
Invitational Workshop on Data Integrity held at NIST.  (

Unfortunately, due to technology obsolescence  I don't have 
soft-copy, but  as I recall it was reprinted in a compendium of 
integrity papers edited by Marshall Abrams.  And I'd be happy 
to send you a hard copy if you are interested.)

In that paper, I tried to address the concerns raised by Clark 
and Wilson regarding integrity, and laid out an approach to 
integrating integrity considerations with confidentiality 
considerations using the classical Biba/Bell-Lapadua 
mandatory access control model of a Trusted Computer Base.

Unlike conventional military systems, where the security 
classification level is normally the primary concern, and 
compartments or categories are the exception, in the Biba 
model and my extension, the compartments become 
capabilities or rules, and the integrity levels are perhaps 
less important.  In particular, each labeled compartment becomes 
a name of or citation to a particular "integrity process rule" which the 
process which created the data is alleged to have satisfied.

But interestingly enough vis a vis your suggestion, I did suggest 
that a probabilistic  or heuristic "confidence level" could perhaps 
be used as an integrity level, as part of the mandatory access 
control decision.

And I quite agree that although "trust" without a predicate 
"with respect to rule X" is meaningless, "reliance" can be 
binary if the rules are satisfied to an acceptable level of 
confidence.  And if the reliance part of the equation is 
satisfied, then dependence is presumably a rational decision.  
If the reliance value is not  a binary "TRUE", then dependence 
may still be in order, but based upon other heuristics and/or 
perception of risks, even down to the gut-level hunch, so 
long as it is the relying party's money that he is betting.

Regards,

Bob

Robert R. Jueneman
Security Architect

Novell, Inc -- the leading provider of Net services software

>>> Michael Sierchio <[email-masked]> 01/22/01 05:08PM >>>
Bob Jueneman wrote:

> In other words, trust, like integrity, is not some binary value that is
> independent of any predicate.  Instead, something, either a process
> or the data that was produced as a result of some process, is "trusted"
> if and only if the process conforms to a specified set of rules or
> expectations.  It is clearly not possible for a process to be tested
> against all possible rules in the universe, so without qualifying the
> trust to a particular set of rules, the question is meaningless.

Trust may be fuzzy -- it depends on subjective evaluation, etc. But
reliance follows an act of defuzzification (a technical term, believe
it or not) in which the fuzzy output set is converted to a crisp
(yes, binary) number (we open the box and the cat is either dead or 
alive).

Open to the chapter with the heading:

	Trust -> Confidence -> Reliance -> Dependence

Audun Jøsang(*) suggests an interesting approach to modelling trust. 
Belief trust requires an assessment of external data (or capta), the
accuracy, completeness, truthfulness and reliability of which may
not be known perfectly by a relying party.

Even with a fixed ruleset it seems to me that the problem is one
of constraint based reasoning under conditions of uncertainty.
Do you propose that a validation responder, for example, reply with a 
membership grade (percent probability of being valid)?  That actually
seems reasonable and promising.  This is a nascent research area.

*)
	http://www.item.ntnu.no/~ajos/PhD.html

---

From: Ed Gerck <[email-masked]>
Date: Mon, 22 Jan 2001 23:35:03 -0800

> satisfied, then dependence is presumably a rational decision.

In deed, Trust can be defined as "that which I rely upon for my decisions".
But this is only the subjective stance (eg, for one host, for mysef, etc.).
It does not work intersubjectively, for example between Internet hosts.

In such cases, rather than saying "A trusts B", one should say (and define)
"A trusts B on matters of X at epoch T" because trust depends on time
and locality (epoch) as well as "matters of X" (the predicate).

More on this approach and the information-theoretic definition of trust
in http://www.mcg.org.br/trustdef.htm

Cheers,

Ed Gerck