Instructor: Dr. William H. Winsborough
Class Periods: MW 5:30 - 6:45pm
Lecture Hall: SB 3.01.04
Course Homepage: http://www.cs.utsa.edu/~winsboro/teaching/CS6463-S06/
Prerequisits: Consent of instructor.
Text: None. This course will be based on papers from the research literature that will be selected and made available by the instructor though the course home page.

Instructor Office: HSS 4.02.52
Office Hours: MW 4-5:15pm and by appointment
Phone: (210) 458-5659
Email Address: winsboro at cs dot utsa dot edu

Course Objective: To become acquainted with the trust-management approach to authorization in decentralized systems and to the variety of trust-management systems proposed and in use today.
Course Description: Trust management is an approach to designing authorization systems for use in decentralized environments, such as business partnerships or coalition operations, and open systems, such as the Internet. Owing to the scale of these contexts, resources (such as files, software, or computing equipment) need to be shared selectively with resource requesters (such as users, servers, or processes) with whom the resource owner may not have a prior, existing relationship. Consequently, access control policies must be able to utilize information from various sources about resource requesters, and make decisions about who gets access by combining such information appropriately and securely. This class will study practical and theoretical issues in design and construction of trust management systems. It will also study other, more centralized access control systems, such as role-based access control, for the purpose of understanding the strengths and weaknesses of the various approaches to managing authorization. In addition, the course will consider emerging tools and techniques that can be used by authors of access-control policy authors to ensure that policy objectives are met.

Course Activities:

• Paper synopsis. Before lecture(s) on each paper, students are required to hand in a one page discussion of the key contributions of the paper, as well as an assessment of the significance of the paper and of the areas in which the student feels the paper was successful and the areas in which it is lacking. The goal of these synopses is to demonstrate that the student has made a significant effort to understand the paper and has thought about its goals and whether it meets them. Synopses are due at the start of the first lecture on the corresponding paper.
• Participation in discussions. The instructor will devote one or more lecture periods to each paper. The lectures will require a high degree of student participation, particularly with respect to the assessment of the papers. Though the discussions will be lead by the instructor, all students will be expected to participate and to cooperate with the group as we strive to share a stimulating and insightful analytical experience. Note that attendance is mandatory.
• Extended synopsis. After the lectures on a given paper are complete, each student will revise and extend their synopsis of the paper. The extended synopses should be no more than 3 pages using 11 point font and 1 inch margins.
• Class project. Each student will complete a class project, the content of which will be agreed upon with the instructor. Typical examples would be to develop a small application by using one or more trust management software packages, or to write a paper comparing and contrasting trust management techniques and discussing their advantages and disadvantages. The project should be seen as an opportunity to taylor the course content to the taste of the individual student.

• Paper synopses: 20%
• Participation in discussion: 25%
• Extended synopses: 25%
• Class project: 30%