Authentication in the Taos operating system

ABSTRACT

We describe a design for security in a distributed system and its implementation. In our design, applications gain access to security services through a narrow interface. This interface provides a notion of identity that includes simple principals, groups, roles, and delegations. A new operating system component manages principals, credentials, and secure channels. It checks credentials according to the formal rules of a logic of authentication. Our implementation is efficient enough to support a substantial user community.

REFERENCES

• 1: M. Abadi , M. Burrows , C. Kaufman , B. Lampson, Authentication and delegation with smart-cards, Science of Computer Programming, v.21 n.2, p.93-113, Oct. 1993
• 2: Martín Abadi , Michael Burrows , Butler Lampson , Gordon Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems (TOPLAS), v.15 n.4, p.706-734, Sept. 1993 [doi>10.1145/155183.155225]
• 3: BIRRELL, A., HISGEN, A., JERIAN, C., MANN, T., AND SWART, G. 1993. The Echo distributed file system. Rep. 111, Systems Research Center, Digital Equipment Corp., Palo Alto, Calif.
• 4: CCITT. 1988. Information processing systems Open systems interconnection--The directory authentication framework. CCITT 1988 Recommendation X.509, Geneva, Switzerland.
• 5: EBERLE, a. AND THACKER, C. 1992. A 1 Gbit/seeond GaAs DES chip. In Proceedings of the IEEE Custom Integrated Circuit Conference. IEEE, New York, 19.7.1 19.7.4.
• 6: GASSER, M., GOLDSTEIN, A., KAUFMAN, C., ~D LAMPSON, B. 1989. The Digital distributed system security architecture., In Proceedings of the 12th National Computer Security Conference. NIST/NCSC, 305 319.
• 7: HERBISON, B. 1990. Low cost outboard cryptographic support for SILS and SP4. In Proceed~ ings of the 13th National Computer Security Conference. NIST/NCSC, 286-295.
• 8: Donald E. Knuth, The art of computer programming, volume 3: (2nd ed.) sorting and searching, Addison Wesley Longman Publishing Co., Inc., Redwood City, CA, 1998
• 9: Butler W. Lampson, Protection, ACM SIGOPS Operating Systems Review, v.8 n.1, p.18-24, January 1974 [doi>10.1145/775265.775268]
• 10: Butler Lampson , Martín Abadi , Michael Burrows , Edward Wobber, Authentication in distributed systems: theory and practice, ACM Transactions on Computer Systems (TOCS), v.10 n.4, p.265-310, Nov. 1992 [doi>10.1145/138873.138874]
• 11: NATIONAL BUREAU OF STANDARDS. 1977. Data Encryption Standard. FIPS Pub. 46, Washington, D.C.
• 12: Roger M. Needham, Cryptography and secure channels, Distributed systems (2nd Ed.), ACM Press/Addison-Wesley Publishing Co., New York, NY, 1993
• 13: CORPORATE Open Software Foundation, Introduction to OSF DCE (rev. 1.0), Prentice-Hall, Inc., Upper Saddle River, NJ, 1992
• 14: QUISQUATER, J.-J., DE WALEFFE, D., AND BOURNAS, J.-P. 1991. Corsair: A chip card with fast RSA capability, tn Smart Card 2000. Elsevier, New York, 199 206.
• 15: Ronald L. Rivest, The MD4 Message Digest Algorithm, Proceedings of the 10th Annual International Cryptology Conference on Advances in Cryptology, p.303-311, August 11-15, 1990
• 16: R. L. Rivest , A. Shamir , L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Communications of the ACM, v.21 n.2, p.120-126, Feb. 1978 [doi>10.1145/359340.359342]
• 17: Michael D. Schroeder , Michael Burrows, Performance of the Firefly RPC, ACM Transactions on Computer Systems (TOCS), v.8 n.1, p.1-17, Feb. 1990 [doi>10.1145/77648.77653]
• 18: SHAND, M., AND VUILLEMIN, J 1993. Fast implementations of RSA cryptography In the 11 Symposium on Computer Amthmetzc. IEEE Computer Socmty, Washington, D C
• 19: STEINER, J., NEUMAN, C., AND SCHILLER, J. 1988. Kerberos: An authentication servme for open network systems. In Proceedings of the USNIX Winter Conference (1988). USNIX Association, Berkeley, Calif., 191 202.
• 20: Charles P. Thacker , Lawrence C. Stewart , Edwin H. Satterthwaite, Jr., Firefly: A Multiprocessor Workstation, IEEE Transactions on Computers, v.37 n.8, p.909-920, August 1988 [doi>10.1109/12.2243]

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS

  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

General Terms:
Design, Security, Theory

Keywords:
cryptography, mathematical logic