UCLA

The Internet connects entities in trust relationships in cyberspace. However, the original Internet protocol stack lacked built-in security protection. As new threats emerged, security features were added as patches, resulting in a patchwork of incompatible solutions. This accumulation of retrofits created a fragmented security landscape, in which each application must develop its own protection mechanisms. Consequently, implementations of modern defense strategies, such as Zero Trust, often depend on practitioners assembling multiple independently developed or isolated solutions. This dissertation aims to enable systematic development of security solutions by introducing a framework, called a trust plane, that represents and formalizes existing trust relationships among entities in cyberspace. Trust plane uses semantic naming and provides structured support for core security functions—authentication, authorization, and auditing (the 3As). This dissertation formulates the trust plane framework, identifying and designing the system components and functions needed to implement it. These include a functional module for managing security parameters and APIs that applications utilize to secure data communications; mechanisms for securely bootstrapping new entities with the necessary parameters for authenticated and authorized communication; mechanisms for maintaining trust relationships over time; and an immutable ledger that supports data auditing. The utility of the trust plane is demonstrated through a case study in the cellular core, illustrating how it enables control plane functions within the cellular core to communicate securely while significantly reducing system complexity and security overhead compared to existing implementations. As the first work to establish and implement a trust plane, this dissertation outlines a path toward an Internet where applications are provided with systematic support for authentication, authorization, and auditing.