Skip to main content
SpringerLink
Log in
Book cover

Cambridge International Workshop on Security Protocols

Security Protocols 2016: Security Protocols XXIV pp 35–38Cite as

The Price of Belief: Insuring Credible Trust?

  • Conference paper
  • First Online:

  • 372 Accesses

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10368))

Abstract

Today, the majority of distributed system users are not systems programmers, nor do they aspire to be. The problem with existing access control mechanisms is not that they don’t work, it is that users despise them and will not interact with them in the way the security model requires. We argue that this is not primarily a user-education issue; instead the user interface needs to be re-factored in a way that will involve a radical change to the way security is modelled.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    Thus meeting Roger Needham’s definition of optimization as replacing something good that works by something better that almost works.

  2. 2.

    This idea is not new, see [7]. However, it is worth pointing out that the variance of an anticipated loss is at least as important to model as its expectation – people buy both insurance and lottery tickets. See Clarke et al. [4].

  3. 3.

    It seems, however, that in this case card issuers may be attempting to pass some of the cost of this risk on to the cardholder, as the latter is charged for these transactions until and unless they identify them on their statements and inform the issuer [6].

  4. 4.

    Suitable mechanisms for this are provided, although not described in these terms, by Chuang and Wernick [3].

  5. 5.

    A claim corresponds to a case where the access is subsequently determined to have been unauthorized.

  6. 6.

    If two non-identical binary access control policies are jointly enforced then, for some query, conflicting outcomes (‘allow’ and ‘deny’) must be combined. Usually this combination is interpreted as ‘deny’ which, as indicated above, can be problematic.

References

  1. Adams, A., Sasse, M.A.: Users are not the enemy. Commun. ACM 42(12), 41–46 (1999). doi:10.1145/322796.322806

    Article  Google Scholar 

  2. Bella, G., Viganò, L.: Security is beautiful. In: Christianson, B., Švenda, P., Matyáš, V., Malcolm, J., Stajano, F., Anderson, J. (eds.) Security Protocols 2015. LNCS, vol. 9379, pp. 247–250. Springer, Cham (2015). doi:10.1007/978-3-319-26096-9_25

    Chapter  Google Scholar 

  3. Chuang, S., Wernick, P.: A credibility-based model of computer system security. In: Proceedings of New Security Paradigms 1996, Lake Arrowhead CA, 17–19 September 1996, pp. 53–58. ACM Press (1996)

    Google Scholar 

  4. Clarke, S., Christianson, B., Xiao, H.: Trust*: using local guarantees to extend the reach of trust. In: Christianson, B., Malcolm, J.A., Matyáš, V., Roe, M. (eds.) Security Protocols 2009. LNCS, vol. 7028, pp. 171–178. Springer, Heidelberg (2013). doi:10.1007/978-3-642-36213-2_21

    Chapter  Google Scholar 

  5. Maw, H.A., Xiao, H., Christianson, B., Malcolm, J.: An evaluation of break-the-glass access control model for medical data in wireless sensor networks. In: Proceedings of IEEE 16th International Conference on e-Health Networking, Applications and Services (Healthcom), 15–18 October 2014, Natal, United Kingdom, pp. 130–135. IEEE (2015). doi:10.1109/HealthCom.2014.7001829

  6. Osborne, H., Hartley, E.: Contactless payments mean card fraud now happens after cancellation. Guardian Money (2015). http://www.theguardian.com/money/2015/dec/19/contactless-payments-card-fraud-after-cancellation-bank-account. Accessed 22 Jan 2016

  7. Wheeler, D.: Transactions using bets. In: Lomas, M. (ed.) Security Protocols 1996. LNCS, vol. 1189, pp. 89–92. Springer, Heidelberg (1997). doi:10.1007/3-540-62494-5_7

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Hertfordshire, College Lane, Hatfield, Herts, AL10 9AB, England

    Paul Wernick & Bruce Christianson

Authors
  1. Paul Wernick
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Bruce Christianson
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Bruce Christianson .

Editor information

Editors and Affiliations

  1. Memorial University, St. John’s, Newfoundland and Labrador, Canada

    Jonathan Anderson

  2. Faculty of Informatics, Masaryk University, Brno, Czech Republic

    Vashek Matyáš

  3. University of Hertfordshire, Hertfordshire, United Kingdom

    Bruce Christianson

  4. University of Cambridge, Cambridge, United Kingdom

    Frank Stajano

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Wernick, P., Christianson, B. (2017). The Price of Belief: Insuring Credible Trust?. In: Anderson, J., Matyáš, V., Christianson, B., Stajano, F. (eds) Security Protocols XXIV. Security Protocols 2016. Lecture Notes in Computer Science(), vol 10368. Springer, Cham. https://doi.org/10.1007/978-3-319-62033-6_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-62033-6_5

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-62032-9

  • Online ISBN: 978-3-319-62033-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation