Separating Between Trust and Access Control Policies: A necessity for Web Applications

As Security is the key of success for Web Applications most of the efforts that have been put in this domain have focused on wining users’ trust to adopt the Web environment for their business operations. Although user trust is of paramount importance for Web applications, one also needs to consider Web applications trust towards users here after referred to as user trustworthiness. This paper explains why management of trust/mistrust is an increasing security issue in Web environment and proposes an authorization architecture framework that clearly separates between access control policies and mistrust management. It also describes a model that evaluates trustworthiness of users trust towards its integration in the authorization process.