Automated trust negotiation (ATN) is an important means to establish trust between strangers through the exchange of digital credentials and mobile access control policies specifying what combinations of credentials a stranger must submit. As a certificate may contain sensitive information, unlimited disclosure will leak valuable information or jeopardize individual privacy. In order to prevent information leakage, the negotiation protocol is designed so complicated that a requestor is hard to attain the access. In addition, if the encryption algorithm is short in security intensity, the transmitting message over the public channel is easy to be attacked To solve these problems, an Asymmetrical Encryption Based ATN Model (AEBM) is proposed in this paper. AEBM adopts credentials with a flexible format to meet the requirements of access control policies, instead of disclosing the whole contents of a certificate. Further, AEBM uses asymmetric encryption technique to encrypt the transmitting message, which can prevent information from leaking. AEBM presents a new negotiation strategy to enhance the negotiation efficiency. A use case is studied to prove that AEBM is sound and reasonable.
展开▼
