A Hybrid Trust Model for Authorisation Using Trusted Platforms

Authorisation systems play a vital role in protecting access to resources in distributed systems. Traditionally, authorisation is performed at the user level to determine whether a user has the necessary privileges to access a requested resource. However, when it comes to the user´s platform, it is often assumed that the system hosting the user and the software running on it are ´trusted´ and that it will behave correctly. In this paper, we propose a hybrid trust model that provides techniques for authorisation taking into account state of user platforms leveraging trusted computing technology. The model encompasses the notions of ´hard´ and ´soft´ trust to determine whether a platform can be trusted for authorisation. We first explain the rationale for the model and then provide a description of the proposed hybrid model.