A trust and Contract Management framework enabling secure collaborative business
processing in on-demand created, self-managed, scalable, and highly dynamic Virtual
Organisations
http://www.eu-trustcom.com
TRUSTCOM – Intelligent
planning for an intelligent grid
Michael Wilson
CCLRC
Business Relationship
Agreements
Enforcing Inter-Enterprise
Policies
• Contract
– Clauses in natural language
– Some translated into XML policies
• Identification of Parties
• Business Process Description
– What you do & when you do it (UML -> CDL -> BPEL)
• Service level agreements
– Quality of what you do (WSLA)
• Confidentiality Clauses
– Who can access which resources, when
» Trust policies
» Access control policies
» Privacy policies
Loading Policies
• Policies are derived from the terms and
conditions of the VO Agreement
• During the formation and the evolution
phase of the VO, policies are loaded into
the policy service(s) and into the policy
decision points.
Policy Languages
• Authorisation policies follow the XACML
1.1 standard with extensions for
expressing delegation policies
• An “event-condition-action” rule encoding
was chosen for obligation policies (also
sometimes called adaptation policies)
• Policy actions are typically web-service
invocations that are made on
administrative services
TrustCom Architecture
implemented using WS* standards
Events, policies, actions
Business Relationship Cycle
Preparation Process
Identification
Formation
Operation
Trustcom Outputs
• Trustcom Framework (concepts & architecture) – Jan ‘07
• Generic Tools and Methods to execute Framework –
Feb ‘07
– freely available, open source licences
– modules exploited by companies in products
• Infrastructure (BT), Collaborative BP (SAP), Security Token Service
(MS), Supplier Qualification (IBM)
• Evaluated demonstrators to show business benefits of
applying Trustcom Framework – May ‘07
– Distributed Aerospace Engineering (BAE Systems)
• 20 year, supply chain
– Aggregated application services (BT, Atos Origin)
• 5 days, shared risk collaborations
TrustCoM Limitations
• TrustCoM does not address the complete set of
requirements – e.g. there is no financial accounting.
• The controlled vocabularies used in the contracts,
SLAs and policies in TrustCoM are neither complete
nor optimal. Considerable further development will be
required to define these for specific industrial sectors
and have their interpretation agreed by commercial
managers and lawyers.
• There is no method to prove that policies have been
enforced.
• There is no method or tool to analyse policies, identify
or resolve conflicts between them, or identify policy
omissions compared to a priori models.