Integrating security in a large distributed system

ABSTRACT

Andrew is a distributed computing environment that is a synthesis of the personal computing and timesharing paradigms. When mature, it is expected to encompass over 5,000 workstations spanning the Carnegie Mellon University campus. This paper examines the security issues that arise in such an environment and describes the mechanisms that have been developed to address them. These mechanisms include the logical and physical separation of servers and clients, support for secure communication at the remote procedure call level, a distributed authentication service, a file-protection scheme that combines access lists with UNIX mode bits, and the use of encryption as a basic building block. The paper also discusses the assumptions underlying security in Andrew and analyzes the vulnerability of the system. Usage experience reveals that resource control, particularly of workstation CPU cycles, is more important than originally anticipated and that the mechanisms available to address this issue are rudimentary.

REFERENCES

• 1: ACCETTA, M. J., ROBERTSON, G. G., SATYANARAYANAN, M., AND THOMPSON, M. The design of a network-based central file system. Tech. Rep. CMU-CS-80-134, Dept. of Computer Science, Carnegie Mellon Univ., Pittsburgh, Pa., Aug. 1980.
• 2: ADVANCED MICRO DEVICES. MOS Microprocessors and Peripherals, 1985.
• 3: Andrew D. Birrell , Roy Levin , Michael D. Schroeder , Roger M. Needham, Grapevine: an exercise in distributed computing, Communications of the ACM, v.25 n.4, p.260-274, April 1982 [doi>10.1145/358468.358487]
• 4: Andrew D. Birrell, Secure communication using remote procedure calls, ACM Transactions on Computer Systems (TOCS), v.3 n.1, p.1-14, Feb. 1985 [doi>10.1145/214451.214452]
• 5: BURROWS, M. L., ABADI, M., AND NEEDHAM, R.N. A logic of authentication. Tech. Rep. 39, Digital Equipment Corporation, Systems Research Center, Palo Alto, Calif., Feb. 1989.
• 6: David R. Cheriton , Willy Zwaenepoel, The distributed V kernel and its performance for diskless workstations, Proceedings of the ninth ACM symposium on Operating systems principles, p.129-140, October 10-13, 1983, Bretton Woods, New Hampshire, United States
• 7: CRUMLEY, P. TRADMYBD: Data Encryption Adapter Technical Reference Manual and Programmers' Guide, Version 0.20. Tech. Rep. CMU-ITC-059, Information Technology Center, Carnegie Mellon Univ., Pittsburgh, Pa., Dec. 1986.
• 8: Roger Berry Dannenberg, Resource sharing in a network of personal computers, 1982
• 9: DIFFIE, W., AND HELLMAN, M.E. Privacy and authentication: An introduction to cryptography. Proc. IEEE 67, 3 (Mar. 1979), 397-427.
• 10: DoD. Trusted Computer System Evaluation Criteria. CSC-STD-001-83, Dept. of Defense, Computer Security Center, 1985.
• 11: FERNANDEZ, G., AND ALLEN, L. Extending the UNIX protection model with access control lists. In Usenix Conference Proceedings (Summer, 1988).
• 12: GRAMPP, F. T., AND MORRIS, R.H. Unix operating system security. Bell Lab. Tech. J. 63, 8 (Oct. 1984), 1649-1672.
• 13: John H. Howard , Michael L. Kazar , Sherri G. Menees , David A. Nichols , M. Satyanarayanan , Robert N. Sidebotham , Michael J. West, Scale and performance in a distributed file system, ACM Transactions on Computer Systems (TOCS), v.6 n.1, p.51-81, Feb. 1988 [doi>10.1145/35037.35059]
• 14: IBM. IBM 4700 Personal Computer Financial Security Adapter: Guide to Operations. No. 6024361, IBM Corp., 1985.
• 15: IBM. IBM 4700 Personal Computer Financial Security Adapter: Microcode Users Guide. No. 6024362, IBM Corp., 1985.
• 16: Anita Katherine Jones, Protection in programmed systems., 1973
• 17: JONES, A. K., AND WULF, W.A. Towards the design of secure systems. Softw. Pract. Exper. 5 (1975), 321-336.
• 18: Butler W. Lampson, A note on the confinement problem, Communications of the ACM, v.16 n.10, p.613-615, Oct. 1973 [doi>10.1145/362375.362389]
• 19: Edward D. Lazowska , John Zahorjan , David R. Cheriton , Willy Zwaenepoel, File access performance of diskless workstations, ACM Transactions on Computer Systems (TOCS), v.4 n.3, p.238-268, Aug. 1986 [doi>10.1145/6420.6423]
• 20: MEYER, C. H., AND MATYAS, S.M. Cryptography: A New Dimension in Computer Data Security. John Wiley, New York, 1982.
• 21: James H. Morris , Mahadev Satyanarayanan , Michael H. Conner , John H. Howard , David S. Rosenthal , F. Donelson Smith, Andrew: a distributed personal computing environment, Communications of the ACM, v.29 n.3, p.184-201, March 1986 [doi>10.1145/5666.5671]
• 22: Roger M. Needham , Michael D. Schroeder, Using encryption for authentication in large networks of computers, Communications of the ACM, v.21 n.12, p.993-999, Dec. 1978 [doi>10.1145/359657.359659]
• 23: D. Nichols, Using idle workstations in a shared computing environment, Proceedings of the eleventh ACM Symposium on Operating systems principles, p.5-12, November 08-11, 1987, Austin, Texas, United States
• 24: RABIN, M. O., AND TYOAR, J.D. An integrated toolkit for operating system security. Tech. Rep. TR-05-87, Aiken Computation Lab., Harvard Univ., Cambridge, Mass., May 1987.
• 25: Jerome H. Saltzer, Protection and the control of information sharing in multics, Communications of the ACM, v.17 n.7, p.388-402, July 1974 [doi>10.1145/361011.361067]
• 26: SATYANARAYANAN, M. Users, groups and access lists: An implementor's guide. Tech. Rep. CMU-ITC-84-005, Information Technology Center, Carnegie Mellon Univ., Pittsburgh, Pa., Aug. 1984.
• 27: M. Satyanarayanan , John H. Howard , David A. Nichols , Robert N. Sidebotham , Alfred Z. Spector , Michael J. West, The ITC distributed file system: principles and design, Proceedings of the tenth ACM symposium on Operating systems principles, p.35-50, December 1985, Orcas Island, Washington, United States
• 28: SATYANARAYANAN, M. RPC2 User Manual. Tech. Rep. CMU-ITC-84-038, Information Technology Center, Carnegie Mellon Univ., Pittsburgh, Pa., 1986 (revised).
• 29: SIDEBOTHAM, R.N. Volumes: The Andrew file system data structuring primitive. In European Unix User Group Conference Proceedings (Aug. 1986). Also available as Tech. Rep. CMU-ITC- 053, Information Technology Center, Carnegie Mellon Univ., Pittsburgh, Pa., 1986.
• 30: SPECTOR, A. Z., AND KAZAR, M.L. Wide area file service and the AFS experimental system. Unix Rev. 7, 3 (Mar. 1989).
• 31: STEINER, J. G., NEUMAN, C., AND SCHILLER, J.i. Kerberos: An authentication service for open network systems. In Usenix Conference Proceedings (Winter, 1988).
• 32: TAYLOR, B. Secure networking in the Sun environment. In Usenix Conference Proceedings (Atlanta, Ga., Summer, 1986).
• 33: TAYLOR, B. A framework for network security. Sun Technology 1, 2 (Spring 1988).
• 34: U.S. DEPARTMENT OF COMMERCE, N.B.S., Data Encryption Standard. 1977. Federal Information Processing Standards Publication, FIPS PUB 46.
• 35: Victor L. Voydock , Stephen T. Kent, Security Mechanisms in High-Level Network Protocols, ACM Computing Surveys (CSUR), v.15 n.2, p.135-171, June 1983 [doi>10.1145/356909.356913]
• 36: WESTERN DIGITAL CORP. Data Communication Products Handbook, 1985.
• 37: WULF, W. A., LEVIN, R., AND HARBISON, S.P. HYDRA/C.mmp: An Experimental Computer System. McGraw-Hill, New York, 1981.
• 38: ZAYAS, E.R. Administrative cells: Proposal for cooperative Andrew file systems. Tech. Rep. CMU-ITC-060, Information Technology Center, Carnegie Mellon Univ., Pittsburgh, Pa., June, 1987.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS

Additional Classification:
  C. Computer Systems Organization
  C.0 GENERAL

      Nouns: Andrew
  C.2 COMPUTER-COMMUNICATION NETWORKS

  D. Software
  D.4 OPERATING SYSTEMS
      D.4.3 File Systems Management
          Subjects: Distributed file systems

  E. Data
  E.3 DATA ENCRYPTION
      Subjects: Data encryption standard (DES)**

General Terms:
Algorithms, Design, Security