DistOS-2011W Reputation - Revision history

Mdpless2: /* PAPER */

2011-04-12T02:39:17Z

PAPER

← Older revision		Revision as of 02:39, 12 April 2011
Line 2:		Line 2:
	==PAPER==		==PAPER==

	Our final paper can be found here (Over the past week, the grunt of our efforts are displayed on ~~this~~ final paper page).		Our final paper can be found here (Over the past week, the grunt of our efforts are displayed on the "final-paper" wiki page).
	* [[Distributed OS: Winter 2011 Reputation Systems Paper]]		* [[Distributed OS: Winter 2011 Reputation Systems Paper]]

Mdpless2: /* PAPER */

2011-04-12T02:37:28Z

PAPER

← Older revision		Revision as of 02:37, 12 April 2011
Line 2:		Line 2:
	==PAPER==		==PAPER==

	Our final paper can be found here: [[Distributed OS: Winter 2011 Reputation Systems Paper]]		Our final paper can be found here (Over the past week, the grunt of our efforts are displayed on this final paper page).
			* [[Distributed OS: Winter 2011 Reputation Systems Paper]]

	==Members==		==Members==

Nlessard at 02:25, 12 April 2011

2011-04-12T02:25:43Z

← Older revision		Revision as of 02:25, 12 April 2011
Line 1:		Line 1:

			==PAPER==

			Our final paper can be found here: [[Distributed OS: Winter 2011 Reputation Systems Paper]]

	==Members==		==Members==
	* Waheed Ahmed		* Waheed Ahmed
Line 9:		Line 14:
	==Our presentation==		==Our presentation==
	Our current presentation can be viewed at the following link: https://docs.google.com/present/edit?id=0ASS7kj9hfc1aZGRiMjMzOHJfNGhnNzhuamRr&hl=en&authkey=CMHi3KAD		Our current presentation can be viewed at the following link: https://docs.google.com/present/edit?id=0ASS7kj9hfc1aZGRiMjMzOHJfNGhnNzhuamRr&hl=en&authkey=CMHi3KAD

	~~==Our Paper==~~

	~~Our final paper can be found here: [[Distributed OS: Winter 2011 Reputation Systems Paper]]~~

	==The problem==		==The problem==

Wahmed2: /* Issues & Solutions */

2011-04-09T16:54:30Z

Issues & Solutions

← Older revision		Revision as of 16:54, 9 April 2011
Line 66:		Line 66:
	PKI provides mean of guaranteeing the authenticity by issuing digital signature. In order to ensure that electronic document is authentic , which means knowing the person who created the document and it hasn't been modified. They are commonly used for software distribution, financial transaction or to detect forgery or tampering. Further to ensure the authentication digital signature relies on certain type encryption. Digital certificate is mode of encryption on large scale for example secure web server. Digital certificate are validated by PKI by verifying the authenticity of certificate , the validity of certificate and that the certificate is trustworthy. They are issued by an authority referred as Certification Authority. The certificate authority act as the middleman that both computer trust. This helps in avoiding man in the middle attack , certificate authority confirms that computer is in fact who they say they are and the provides the public key of each computer to the other. The digital certificate contains the public key of the entity identified in certificate , it matches a public to a particular individual, and that certificate's authenticity is guaranteed by the issuer, thus digital certificate provides solution to the problem of how to find user's public key and know that its valid.These problems are solved by a user obtaining another user's public key from the digital certificate. The user knows it is valid because a trusted certification authority has issued the certificate. For their own authentication digital certificate rely on public key cryptography. The certification authority signs the certificate with its own private as digital certificate is issued. To validate the authenticity of a digital certificate, a user can obtain that certification authority's public key and use it against the certificate to determine if it was signed by the certification authority.		PKI provides mean of guaranteeing the authenticity by issuing digital signature. In order to ensure that electronic document is authentic , which means knowing the person who created the document and it hasn't been modified. They are commonly used for software distribution, financial transaction or to detect forgery or tampering. Further to ensure the authentication digital signature relies on certain type encryption. Digital certificate is mode of encryption on large scale for example secure web server. Digital certificate are validated by PKI by verifying the authenticity of certificate , the validity of certificate and that the certificate is trustworthy. They are issued by an authority referred as Certification Authority. The certificate authority act as the middleman that both computer trust. This helps in avoiding man in the middle attack , certificate authority confirms that computer is in fact who they say they are and the provides the public key of each computer to the other. The digital certificate contains the public key of the entity identified in certificate , it matches a public to a particular individual, and that certificate's authenticity is guaranteed by the issuer, thus digital certificate provides solution to the problem of how to find user's public key and know that its valid.These problems are solved by a user obtaining another user's public key from the digital certificate. The user knows it is valid because a trusted certification authority has issued the certificate. For their own authentication digital certificate rely on public key cryptography. The certification authority signs the certificate with its own private as digital certificate is issued. To validate the authenticity of a digital certificate, a user can obtain that certification authority's public key and use it against the certificate to determine if it was signed by the certification authority.

	===Issues ~~& Solutions~~===		===Issues Faced by DoD using PKI===
	I found out there are many different implementations of PKI , and they all focuses on their own issues and solutions. For example PKI used in DoD have following issues		I found out there are many different implementations of PKI , and they all focuses on their own issues and solutions. For example PKI used in DoD have following issues

Line 80:		Line 80:

	*While the purpose of using PKI in EC/EB is to provide additional trust to allow the Internet to serve as a vehicle for legally binding transactions , problems still exist with the methodologies associated with establishing a long-term burden of proof. Specifically, there are no widely adopted industry standards for maintenance of electronic signatures or for authenticated timestamps for record maintenance that have stood the test of time. These processes are untried and the case law has not yet been established to convince users that there are no issues with enforcement of these new processes. An additional barrier to EC/EB within this space is the current DoD Certificate policy in which DoD accepts		*While the purpose of using PKI in EC/EB is to provide additional trust to allow the Internet to serve as a vehicle for legally binding transactions , problems still exist with the methodologies associated with establishing a long-term burden of proof. Specifically, there are no widely adopted industry standards for maintenance of electronic signatures or for authenticated timestamps for record maintenance that have stood the test of time. These processes are untried and the case law has not yet been established to convince users that there are no issues with enforcement of these new processes. An additional barrier to EC/EB within this space is the current DoD Certificate policy in which DoD accepts


	===Common Issues With PKI Implementation===		===Common Issues With PKI Implementation===

Wahmed2: /* References */

2011-04-09T16:53:56Z

References

← Older revision		Revision as of 16:53, 9 April 2011
Line 363:		Line 363:

	*SANS Institute InfoSec Reading Room, Common issues in PKI implementations - climbing the Slope of Enlightenment : http://www.sans.org/reading_room/whitepapers/authentication/common-issues-pki-implementations-climbing-slope-enlightenment_1198 date accessed 15th March 2011		*SANS Institute InfoSec Reading Room, Common issues in PKI implementations - climbing the Slope of Enlightenment : http://www.sans.org/reading_room/whitepapers/authentication/common-issues-pki-implementations-climbing-slope-enlightenment_1198 date accessed 15th March 2011

			*"Understanding Digital Certificate" by Microsoft : http://technet.microsoft.com/en-us/library/bb123848%28EXCHG.65%29.aspx date accessed 3rd April 2011

			*"How digital certificate works" by IBM: http://publib.boulder.ibm.com/infocenter/wmqv6/v6r0/index.jsp?topic=/com.ibm.mq.csqzas.doc/sy10580_.htm date accessed 3rd April 2011

Wahmed2: /* Uses and Need of PKI */

2011-04-09T16:50:58Z

Uses and Need of PKI

← Older revision		Revision as of 16:50, 9 April 2011
Line 61:		Line 61:
	In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.		In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.

	===~~Uses and Need of~~ PKI===		===PKI===
	With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.		With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.

	PKI provides mean of guaranteeing the authenticity by issuing digital signature.		PKI provides mean of guaranteeing the authenticity by issuing digital signature. In order to ensure that electronic document is authentic , which means knowing the person who created the document and it hasn't been modified. They are commonly used for software distribution, financial transaction or to detect forgery or tampering. Further to ensure the authentication digital signature relies on certain type encryption. Digital certificate is mode of encryption on large scale for example secure web server. Digital certificate are validated by PKI by verifying the authenticity of certificate , the validity of certificate and that the certificate is trustworthy. They are issued by an authority referred as Certification Authority. The certificate authority act as the middleman that both computer trust. This helps in avoiding man in the middle attack , certificate authority confirms that computer is in fact who they say they are and the provides the public key of each computer to the other. The digital certificate contains the public key of the entity identified in certificate , it matches a public to a particular individual, and that certificate's authenticity is guaranteed by the issuer, thus digital certificate provides solution to the problem of how to find user's public key and know that its valid.These problems are solved by a user obtaining another user's public key from the digital certificate. The user knows it is valid because a trusted certification authority has issued the certificate. For their own authentication digital certificate rely on public key cryptography. The certification authority signs the certificate with its own private as digital certificate is issued. To validate the authenticity of a digital certificate, a user can obtain that certification authority's public key and use it against the certificate to determine if it was signed by the certification authority.

	===Issues & Solutions===		===Issues & Solutions===

Wahmed2: /* Uses and Need of PKI */

2011-04-09T16:18:25Z

Uses and Need of PKI

← Older revision		Revision as of 16:18, 9 April 2011
Line 63:		Line 63:
	===Uses and Need of PKI===		===Uses and Need of PKI===
	With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.		With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.

			PKI provides mean of guaranteeing the authenticity by issuing digital signature.

	===Issues & Solutions===		===Issues & Solutions===

Wahmed2: /* Uses and Need */

2011-04-08T23:32:03Z

Uses and Need

← Older revision		Revision as of 23:32, 8 April 2011
Line 61:		Line 61:
	In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.		In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.

	===Uses and Need===		===Uses and Need of PKI===
	With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.		With development of modern e-commerce based businesses which has minimal customer face-to-face interactions is demanding more security and integrity. The online web based stores where huge amount of transactions take place needs to ensure customers that there information is confidential and processed through a secure channel. This is where implementation of PKI steps in to provide mechanisms to ensure trusted relationships are established and maintained. The specific security functions in which a PKI can provide foundation are confidentiality, integrity, non-repudiation,and authentication.

Wahmed2: /* Problems */

2011-04-08T23:15:29Z

Problems

← Older revision		Revision as of 23:15, 8 April 2011
Line 44:		Line 44:
	In our paper we must explain why PKI/Authentication fits into reputation. Why must it be handled by both Attribution and Reputation systems?		In our paper we must explain why PKI/Authentication fits into reputation. Why must it be handled by both Attribution and Reputation systems?

	===~~Problems~~===		===Problem Domain===

			This portion of a reputation system answers the core question of how reputation information being exchanged is guaranteed to be authentic.

			*How do we ensure the information exchanged between peers authentic, and not tampered with?

			*How to we attribute information exchanged?

			*How do we do this in a highly decentralized, distributed system?

			*How can we make sure the information is timely?

	===Introduction===		===Introduction===

Wahmed2: /* Introduction */

2011-04-08T23:13:18Z

Introduction

← Older revision		Revision as of 23:13, 8 April 2011
Line 47:		Line 47:

	===Introduction===		===Introduction===
	In past few years, Internet has provided platform for a global market place and both business and private users realizes that the revolutionary communications opportunities provided by it will give way to large spectrum of business and private applications.Today online users face multitude of problems and issues like vulnerability to viruses , worms , exposure to sniffers, spoofing their private sessions not only this but also they are also subjected to invasion of privacy with multitude of spy ware available for monitoring how they behave. Today over the internet different kind of activities take place ranging from access to information to entertainment, financial services, product services and even socializing. The frequent usage of internet as an important business tool led to a major increase in deliberate abuse and criminal activities. All the organization operating electronically and trading expose their own information and IT systems to a wide range of security threats. The most common protocols like IP/TCP/UDP are the main targets of potential hackers. Its all because of IPs on which attacks are possible and don't have proper authentication mechanism for any incoming data over internet. In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.		In past few years, Internet has provided platform for a global market place and both business and private users realizes that the revolutionary communications opportunities provided by it will give way to large spectrum of business and private applications.Today online users face multitude of problems and issues like vulnerability to viruses , worms , exposure to sniffers, spoofing their private sessions not only this but also they are also subjected to invasion of privacy with multitude of spy ware available for monitoring how they behave. Today over the internet different kind of activities take place ranging from access to information to entertainment, financial services, product services and even socializing. The frequent usage of internet as an important business tool led to a major increase in deliberate abuse and criminal activities. All the organization operating electronically and trading expose their own information and IT systems to a wide range of security threats. The most common protocols like IP/TCP/UDP are the main targets of potential hackers. Its all because of IPs on which attacks are possible and don't have proper authentication mechanism for any incoming data over internet.

			In order to build secure chain of trust Public-Key Infrastructure is used for internet based communication. It consists of various things like security policy , Certificate authority , registration authority , certificate distribution system PKI enabled applications.

	===Uses and Need===		===Uses and Need===