An intruder model for trust negotiation

In a distributed environment, and more specially in service oriented architectures, the entities interacting one with another rely on credentials to decide whether an action they are told to perform is permitted. These credentials are exchanged within trust negotiation sessions during which the participating entities build up trust by communicating certificates to trusted peers. Dolev and Yao have introduced a notion of symbolic intruder to represent the capacities of a malicious agent trying to attack a cryptographically secured communication protocol. We present in this paper an adaptation of that intruder that retains the same deductive capabilities but is specialized for the analysis of the exchanges during a trust negotiation session. In particular this permits us to analyze the security of a distributed access control policy w.r.t. a malicious insider.