[Peertrust-discuss] My work on PeerTrust

[Sebastian W. <se...@gm...>]

Hi!

Mr. Olmedilla wanted the people that are involved in the PeerTrust-project
to summarize what they have done so far. In my Bachelor-thesis I have to do
with the security-part in PeerTrust, so I will give a short overview of what
I did until now.

The first task was to implement a special authenticatesTo-predicate. The
extaxt syntax is authenticatesTo(Identity,Party,Authority)@Requester and it
means that Party must proove to Requester that he posseses a
X.509-certificate chain with Identity as subject alias of the first
certificate and Authority as the issuer alias of the last certificate.
First, I solved this task with additional SSLSockets, because the exchange
of the certificate chain is included in the TLS-handshake. But later, we
decided to do it with existing sockets in the MetaInterpreter.java and
MetaInterpreterListener.java. When a MetaInterpreter reveives the
authenticatesTo-query, it is delegated to Requester. He sends a special
Query to Party, which includes the Identity, Authority and a random text
string which Party must use later to proove that he owns the suitable
private key for the public key of the first certificate of the chain. After
receiving the query, Party builds a certificate chain from his keystore that
satisfies the Identity- and Authority-parameters (I wrote a special class
for that). Then, Party searches for the private key that is symmetric to the
public key of the first certificate of the chain and decrypts the random
text string with it. This decrypted text is sent back to Requester along
with the Identity and Authority. The Requester validates the certificate
chain and encrypts the decrypted string with the public key of the first
certificate of the chain and compares the result with the random text he
sent before. This way, Requester can decide, if Party was able to
successfully authenticate himself. The handling of this communication is in
a separate class, I had to include a few method calls for it in the
MetaInterpreter.java and MetaInterpreterListener.class for it. I also used
the CertificateChain-class I wrote, as already mentioned.

The second task consisted of validating the proof tree that is included in
every Tree-object, so that a server can find out if the answer he received
from another peer is right. When I began my Bachelor-thesis, the proof tree
consisted of a single string. This is ok for normal rules, but not for
signed rules, because they have also a matching credential. This can't be
included in a simple string. So I store all the rules of the proof tree in a
vector, which stores the rules in special classes. The normal rule-class has
just a string as attribute, the signed rule-class extends it and has also
the matching credential and a certificate chain (the same class I used in
the first task) as attributes. When a server receives an answer now, he can
iterate through the proof vector. All string representations of the rules
are added to a prolog-inference engine. If there is a signed rule, he can
check, if the included credential is valid (with the credential himself and
the certificate chain). When all rules are valid and added the the inference
engine, it is used to find out, if the goal of the the query can be
constructed from the rules. I had to include the new proof vector in the
Tree.java and Answer. java, along with additional methods. The validation of
the proof tree is included in a separate-class and is called from the
MetaInterpreterListener. Again, I used my CertificateChain-class.

My third task was the verification of the credentials. As those are included
in X.509-Credentials and another student has written some classes for
credentials (without verification), this was the easiest task. I just check,
if the signer of the string representation of the credential is the same as
the subject alias of the certificate, if the certificate is valid and verify
it with the suitable public key. This all is done already in the validation
of the proof tree (the second task).

This is what I have done so far (I hope, my summarization isn't too long and
boring ;-) ).

Best regards,
	Sebastian Wittler

-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info