{'fraction_non_alphanumeric': 0.030953110634385536, 'fraction_numerical': 0.0027581979773214833, 'mean_word_length': 4.696335078534031, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Role of Policies in a Distributed Trust Framework

Abstract The last few years have seen an explosive growth of the e-service offered over the Internet. E-service provision is evolving from a centralized model to a distributed and dynamic one. Identity, rights, non-repudiation, access control and QoS are extremely important aspects in such a distributed e-service framework. This paper briefly describes our distributed trust model that underpins the e-service framework and the role policies have within it. 1. Introduction The last few years have seen an explosive growth of the e-service offered over the Internet. Furthermore e-service provision is evolving from a centralized model to a distributed and dynamic one [1]. In this new world, users go over the Internet to a series of outsourced e-services rather than to internal corporate services. It is up to the users to decide whom they trust or their companies may provide them with policies defining who to trust. Equally, services say trust me; to support this statement a service advertises its compliance with policies provided from a variety of sources to potential customers. A distributed trust model is needed to communicate trust properties [2] and control access between users and services. After a description of some aspects related to e-services, we briefly describe our distributed trust model and the role policies play within it. 2. E-Services Whilst the emphasis of this paper is not on describing what e-services are or how they are realised [3] the aim is to clarify the trust relationship between such Internet-based services. Some assumptions are made about properties associated with e-services. Firstly, they are Internet enabled services accessible to users or other services. Secondly, it is believed that e-services will be composed and that the e-service will use other e-services to fulfil users’ requests. Finally, trust is a two-way thing and the e-service must validate the user and, equally, it must present an identity [4] and trust credentials allowing the user to believe it can deliver the service. 3. Distributed Trust Model The basic trust concepts that underpin our distributed trust model are “trusted third party” and “non-repudiation”. This paper doesn’t intend to describe “non-repudiation” in detail, but put simply it provides a long term proof of intent and it is implemented by standard PKI techniques. This section focuses more on the role of trusted third parties as certificate authorities (CAs), rights providers and policy providers (described in the next section). In the e-service world each user or e-service is vouched for by other entities and trust is derived by finding mutually acceptable trust providers, for example, the standard CA trust hierarchies [5]. Each entity will have credentials [6] issued by “rights providers” that implies they have rights to ‘do something’. Credentials are given by one entity to a user or a set of users (or service) and a third party e-service can check and potentially change them. A user from a set of potential users accesses one of a set of e-services. To do this they contact an e-service who validates their identity using standard PKI techniques with an identity provider (a CA). An e-service can also