Distributed Systems - Revision history

141.20.21.148: /* Insights from Dependability */

2005-01-04T11:59:12Z

Insights from Dependability

← Older revision		Revision as of 11:59, 4 January 2005
Line 100:		Line 100:

	===Insights from Dependability===		===Insights from Dependability===
	Dependability research has obtained a few insights into the complexities		Dependability research has obtained a few insights into the complexities of
	ensuring availability as well as into the effectiveness of possible solutions.		ensuring availability as well as into the effectiveness of possible solutions.
	Its most basic model is the famous "Fault-Error-Failure" sequence of		Its most basic model is the famous "Fault-Error-Failure" sequence of

141.20.21.148: /* Old Data */

2005-01-04T11:58:18Z

Old Data

← Older revision		Revision as of 11:58, 4 January 2005
Line 85:		Line 85:
	Concurrency is when processes or tasks run at the same time. A lot of problems of concurrent processes arise from the access to data or ressources. This involves certain constraints on data, like consistency, as well as from different access protocol problems, e.g. deadlocks. Usually protocols are designed to solve these problems. A lot of research has been done in the field of databases which deal with large amounts of data and concurrent access problems. This includes concurrency control protocols, deadlocks, transaction concepts. However there are a number of problems that are inherently security related. Some of these will be discussed here.		Concurrency is when processes or tasks run at the same time. A lot of problems of concurrent processes arise from the access to data or ressources. This involves certain constraints on data, like consistency, as well as from different access protocol problems, e.g. deadlocks. Usually protocols are designed to solve these problems. A lot of research has been done in the field of databases which deal with large amounts of data and concurrent access problems. This includes concurrency control protocols, deadlocks, transaction concepts. However there are a number of problems that are inherently security related. Some of these will be discussed here.
	=== Old Data ===		=== Old Data ===
	This involves the use of old data in replay attacks, by for instance using old or outdated credentials. As well as race conditions and ''TOCTTOU'' problems. ''TOCTTOU'' means "time-check-to-time-of-use" and specifically refers to timing or ~~syncronization~~ flaws arising from different characteristics of an object at different points in time. ''TOCTTOU'' problems are a subclass of state propagation problems. These arise in large distributed systems, where it may be impossible to hold data about every object available to every entity at any point in time. Examples include public key certificate revocation, as well as hot credit card revocation problems. The usual approach is multi-layer-authorization, which tries to minimize the impact of security state changes by triggering authorization based on the importance or impact of transactions.		This involves the use of old data in replay attacks, by for instance using old or outdated credentials. As well as race conditions and ''TOCTTOU'' problems. ''TOCTTOU'' means "time-check-to-time-of-use" and specifically refers to timing or synchronization flaws arising from different characteristics of an object at different points in time. ''TOCTTOU'' problems are a subclass of state propagation problems. These arise in large distributed systems, where it may be impossible to hold data about every object available to every entity at any point in time. Examples include public key certificate revocation, as well as hot credit card revocation problems. The usual approach is multi-layer-authorization, which tries to minimize the impact of security state changes by triggering authorization based on the importance or impact of transactions.

	=== Inconsistent Updates ===		=== Inconsistent Updates ===
	This refers to the problem of leaving data in inconsistent states. Where consistency is usually a set of "a priori" rules the data must meet. This includes lost updates and incosistent read/write sequences. Usually locking protocols (like 2-Phase-Locking) are applied to solve these problems. These protocols however give rise to the well studied phenomenon of deadlocks. Another way of dealing with the update of data are callback mechanisms.		This refers to the problem of leaving data in inconsistent states. Where consistency is usually a set of "a priori" rules the data must meet. This includes lost updates and incosistent read/write sequences. Usually locking protocols (like 2-Phase-Locking) are applied to solve these problems. These protocols however give rise to the well studied phenomenon of deadlocks. Another way of dealing with the update of data are callback mechanisms.

141.20.21.148: /* Concurrency */

2005-01-04T11:57:19Z

Concurrency

← Older revision		Revision as of 11:57, 4 January 2005
Line 83:		Line 83:

	==Concurrency==		==Concurrency==
	Concurrency is when processes or tasks run at the same time. A lot of problems of concurrent processes arise from the access to data or ressources. This involves certain constraints on data, like consistency, as well as from different access protocol problems, e.g. deadlocks. Usually protocols are designed to solve these problems. A lot of research has been done in the field of ~~data bases~~ which deal ~~which~~ large amounts of data and concurrent access problems. This includes concurrency control protocols, deadlocks, transaction concepts. However there are a number of problems that are inherently security related. Some of these will be discussed here.		Concurrency is when processes or tasks run at the same time. A lot of problems of concurrent processes arise from the access to data or ressources. This involves certain constraints on data, like consistency, as well as from different access protocol problems, e.g. deadlocks. Usually protocols are designed to solve these problems. A lot of research has been done in the field of databases which deal with large amounts of data and concurrent access problems. This includes concurrency control protocols, deadlocks, transaction concepts. However there are a number of problems that are inherently security related. Some of these will be discussed here.
	=== Old Data ===		=== Old Data ===
	This involves the use of old data in replay attacks, by for instance using old or outdated credentials. As well as race conditions and ''TOCTTOU'' problems. ''TOCTTOU'' means "time-check-to-time-of-use" and specifically refers to timing or syncronization flaws arising from different characteristics of an object at different points in time. ''TOCTTOU'' problems are a subclass of state propagation problems. These arise in large distributed systems, where it may be impossible to hold data about every object available to every entity at any point in time. Examples include public key certificate revocation, as well as hot credit card revocation problems. The usual approach is multi-layer-authorization, which tries to minimize the impact of security state changes by triggering authorization based on the importance or impact of transactions.		This involves the use of old data in replay attacks, by for instance using old or outdated credentials. As well as race conditions and ''TOCTTOU'' problems. ''TOCTTOU'' means "time-check-to-time-of-use" and specifically refers to timing or syncronization flaws arising from different characteristics of an object at different points in time. ''TOCTTOU'' problems are a subclass of state propagation problems. These arise in large distributed systems, where it may be impossible to hold data about every object available to every entity at any point in time. Examples include public key certificate revocation, as well as hot credit card revocation problems. The usual approach is multi-layer-authorization, which tries to minimize the impact of security state changes by triggering authorization based on the importance or impact of transactions.

141.20.21.148: /* Distributed Access Control */

2005-01-04T11:56:10Z

Distributed Access Control

← Older revision		Revision as of 11:56, 4 January 2005
Line 40:		Line 40:
	==Distributed Access Control==		==Distributed Access Control==
	Access control refers to the restriction of access to facilities, property, information, ressources etc.		Access control refers to the restriction of access to facilities, property, information, ressources etc.
	Access control is traditionally divided into 2 subtasks, (1) authentication and (2) authorization. (1) deals with identification. It is about knowing if the process or user trying to get access is infact the process or user it is claiming to be. The second task is responsible for granting access to the requested ressource or information. It will be shown here that in distributed systems the 2 task may merge to one.		Access control is traditionally divided into the two subtasks of (1) authentication and (2) authorization.
			(1) deals with identification. It is about knowing if the process or user trying to get access is in fact

			the process or user it is claiming to be.
			The second task is responsible for granting access to the requested ressource or information.
			It will be shown here that in distributed systems both may merge to one.

	=== Access Control Models ===		=== Access Control Models ===
	Access control models are sets of formalized, concise security goals and properties, as well as methods for enforcing them. There are a number of well known access control models, which usually have strong root in the domain they are applied to. A lot of the research done in this area is not primarly rooted in distributed systems, so going from the formal models approaches will be searched that are suitable for the specific tasks and requirements of distributed systems.		Access control models are sets of formalized, concise security goals and properties, as well as methods
			of enforcing them.
			There are a number of well known access control models which usually have strong roots in the domain
			they are applied to.
			A lot of the research done in this area is not primarily rooted in distributed systems, so going from
			the formal models approaches will be searched that are suitable for the specific tasks and requirements
			of distributed systems.

	==== Mandatory Access Control (MAC) ====		==== Mandatory Access Control (MAC) ====
	MAC restricts access to objects on the basis of sensitivity and clearance. Sensitivity is usually represented by a label on the object. Clearance is an information about the principal requesting access. It involves formal authorization. MAC is the fundamental model for military access control. [http://en.wikipedia.org/wiki/Mandatory_access_control (MAC)]		MAC restricts access to objects on the basis of sensitivity and clearance. Sensitivity is usually represented by a label on the object. Clearance is an information about the principal requesting access. It involves formal authorization. MAC is the fundamental model for military access control. [http://en.wikipedia.org/wiki/Mandatory_access_control (MAC)]

	==== Discretionary Access Control (DAC) ====		==== Discretionary Access Control (DAC) ====
	The fundamental term in the access control model is "owner". The owner of an object is fully trusted to manage its security. Owners have or can aquire all rights to their objects. Furthermore owners may grant or deny access to groups or others. DAC is the model behind rights management in the unix world. [http://en.wikipedia.org/wiki/Discretionary_access_control (DAC)]		The fundamental term in the access control model is "owner". The owner of an object is fully trusted to manage its security. Owners have or can aquire all rights to their objects. Furthermore owners may grant or deny access to groups or others. DAC is the model behind rights management in the unix world. [http://en.wikipedia.org/wiki/Discretionary_access_control (DAC)]

	==== Role Based Access Control (RBAC) ====		==== Role Based Access Control (RBAC) ====
	Roles reflect organizational functions. Access rights are granted on the basis of roles. Principals aquire roles and therefor access rights. [http://en.wikipedia.org/wiki/RBAC (RBAC)]		Roles reflect organizational functions. Access rights are granted on the basis of roles. Principals aquire roles and therefor access rights. [http://en.wikipedia.org/wiki/RBAC (RBAC)]
Line 55:		Line 66:
	=== Distributed Authorization ===		=== Distributed Authorization ===
	All described models are		All described models are

	==== Access Control Lists ====		==== Access Control Lists ====
			Access control lists are a common mechanism for access control.
⚫	Access control lists are a well known and often used mechanism for access control. The basic idea is to attach tupels to objects. The tupels map subjects to access rights for every object. This is a well known technique uitilized in operating systems as Windows NT. The idea is to authenticate the user and rely on existing access control lists for the authorization decision. In some cases remote users are mapped to local users. This approach does not allow for delegation and relies heavily on an existing authentication infrastructure, resulting in scalability problems. An example of this technique is [http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 Kerberos], which is build on the Needham-Schroeder protocol.
			The basic idea is to attach tupels mapping subjects to rights to objects.
			This is a well known technique uitilized in operating systems such as Windows NT.
		⚫	The idea is to authenticate the user and rely on existing access control lists for the authorization decision. In some cases remote users are mapped to local users. This approach does not allow for delegation and relies heavily on an existing authentication infrastructure, resulting in scalability problems. An example of this technique is [http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 Kerberos], which is build on the Needham-Schroeder protocol.
	==== Capability-based Authorization ====		==== Capability-based Authorization ====
	Capability based access control attaches tupels to subjects. The tupels map objects to access rights and are stored with every subject. The tupels may be extended by hashes. On creation of the object a secret may be created. The hash is constructed over the secret, an object identifier and the access rights. The hash protects against forgery, while allowing local and fast authorization. With the hash access rights may be granted locally, knowing the secret of the object. However capabilities of this kind may be stolen, leaving unanswered questions of revocation of capabilities.		Capability based access control attaches tupels to subjects. The tupels map objects to access rights and are stored with every subject. The tupels may be extended by hashes. On creation of the object a secret may be created. The hash is constructed over the secret, an object identifier and the access rights. The hash protects against forgery, while allowing local and fast authorization. With the hash access rights may be granted locally, knowing the secret of the object. However capabilities of this kind may be stolen, leaving unanswered questions of revocation of capabilities.

141.20.21.148: /* Introduction */

2005-01-04T11:48:50Z

Introduction

← Older revision		Revision as of 11:48, 4 January 2005
Line 27:		Line 27:
	In combination with the characteristics mentioned above, these result in several topical		In combination with the characteristics mentioned above, these result in several topical
	areas for security.		areas for security.
	First, distributing a system's components strengthens the importance of access control. While access control in systems that are confined to single locations and specified groups of users is already a problem it becomes an almost unsolvable problem when involving magnitudes of locations, different persons in charge, unknown user groups.		First, distributing a system's components strengthens the importance of access control.
			While access control in systems that are confined to single locations and specified groups of users
			is a problem in itself, it becomes almost unsolvable when magnitudes of locations,
			different persons in charge and unknown user groups are involved.
	Consequently, we will focus on distributed access control in the first section of the following text.		Consequently, we will focus on distributed access control in the first section of the following text.
	Service requirements are the second field we will take a look at; here, our main aim		Service requirements are the second field we will take a look at; here, our main aim

217.231.184.77: /* Concurrency */

2004-12-29T22:35:20Z

Concurrency

← Older revision		Revision as of 22:35, 29 December 2004
Line 65:		Line 65:

	==Concurrency==		==Concurrency==
			Concurrency is when processes or tasks run at the same time. A lot of problems of concurrent processes arise from the access to data or ressources. This involves certain constraints on data, like consistency, as well as from different access protocol problems, e.g. deadlocks. Usually protocols are designed to solve these problems. A lot of research has been done in the field of data bases which deal which large amounts of data and concurrent access problems. This includes concurrency control protocols, deadlocks, transaction concepts. However there are a number of problems that are inherently security related. Some of these will be discussed here.
			=== Old Data ===
			This involves the use of old data in replay attacks, by for instance using old or outdated credentials. As well as race conditions and ''TOCTTOU'' problems. ''TOCTTOU'' means "time-check-to-time-of-use" and specifically refers to timing or syncronization flaws arising from different characteristics of an object at different points in time. ''TOCTTOU'' problems are a subclass of state propagation problems. These arise in large distributed systems, where it may be impossible to hold data about every object available to every entity at any point in time. Examples include public key certificate revocation, as well as hot credit card revocation problems. The usual approach is multi-layer-authorization, which tries to minimize the impact of security state changes by triggering authorization based on the importance or impact of transactions.
			=== Inconsistent Updates ===
			This refers to the problem of leaving data in inconsistent states. Where consistency is usually a set of "a priori" rules the data must meet. This includes lost updates and incosistent read/write sequences. Usually locking protocols (like 2-Phase-Locking) are applied to solve these problems. These protocols however give rise to the well studied phenomenon of deadlocks. Another way of dealing with the update of data are callback mechanisms.
			=== Time ===
			Accurate time is needed for a number of security related protocols. This makes providing accurate time a security related problem itself. There are a number of time specific attacks, like the cinderella attack. One example of such an attack is the disabling of security software by manipulating the time, so that specific licenses to use the software expire. Solutions to the problem of secure time include NTP (Network time protocol), which provides for the authentication of time sources, as well as a voting mechanism, reducing the likelihood of manipulations.

	==Fault Tolerance==		==Fault Tolerance==

217.231.184.241: /* Distributed Access Control */

2004-12-29T18:00:30Z

Distributed Access Control

← Older revision		Revision as of 18:00, 29 December 2004
Line 37:		Line 37:
	==Distributed Access Control==		==Distributed Access Control==
	Access control refers to the restriction of access to facilities, property, information, ressources etc.		Access control refers to the restriction of access to facilities, property, information, ressources etc.
	Access control is traditionally divided into 2 subtasks, (1) authentication and (2) authorization. (1) deals with identification. It is about knowing if the process or user trying to get access is infact the process or user it is claiming to be. The second task is responsible for granting access to the requested ressource or information.		Access control is traditionally divided into 2 subtasks, (1) authentication and (2) authorization. (1) deals with identification. It is about knowing if the process or user trying to get access is infact the process or user it is claiming to be. The second task is responsible for granting access to the requested ressource or information. It will be shown here that in distributed systems the 2 task may merge to one.


Line 53:		Line 53:
	All described models are		All described models are
	==== Access Control Lists ====		==== Access Control Lists ====
			Access control lists are a well known and often used mechanism for access control. The basic idea is to attach tupels to objects. The tupels map subjects to access rights for every object. This is a well known technique uitilized in operating systems as Windows NT. The idea is to authenticate the user and rely on existing access control lists for the authorization decision. In some cases remote users are mapped to local users. This approach does not allow for delegation and relies heavily on an existing authentication infrastructure, resulting in scalability problems. An example of this technique is [http://en.wikipedia.org/wiki/Kerberos_%28protocol%29 Kerberos], which is build on the Needham-Schroeder protocol.
	==== Capability-based Authorization ====		==== Capability-based Authorization ====
			Capability based access control attaches tupels to subjects. The tupels map objects to access rights and are stored with every subject. The tupels may be extended by hashes. On creation of the object a secret may be created. The hash is constructed over the secret, an object identifier and the access rights. The hash protects against forgery, while allowing local and fast authorization. With the hash access rights may be granted locally, knowing the secret of the object. However capabilities of this kind may be stolen, leaving unanswered questions of revocation of capabilities.
	==== Credential-based Authorization ====		==== Credential-based Authorization ====
			Some of the problems of capability based authorization can be answered when the hash is extended. ICAP developed by L.Gong also includes user identifiers with the hash, allowing for selective revocation, as well as preventing theft of credentials. Truly distributed security policies are possible. As stated above access control is traditionally divided into 2 tasks authentication andauthorization. The credential based approach, being the most sophisticated so far delivers 2 possible solutions to the whole problem of access control. The first (identitiy based)leaves the distinction between authentication and authorization true, while the second (key-based) merges the 2 processes into one.
			===== Identity-based Credentials =====
			Identity oriented access control is based on names. Names bind access rights to principals/subjects. This seperates the process of controlling access into establishing the identity of a principal (map name to principal) and maping the established name to access rights. Authentication is usually done via public key infrastructures(PKI), while authorization just maps names to access rights (this can be done via ACL). Usually well known and tested standards like X.509 are used.
			Names however comprise a whole new set of problems when used in distributed systems. Certain uniqueness and stability constraints must be met. Central naming authorities need to be established.
			===== Key-based Credentials =====
			In key-based systems the need for central naming authorities is eliminated. Every principal generates own public/private key pair. Public keys are used as global identifiers. Every service is responsible for authentication and authorization. Meaning access decisions are made local. An example of this kind of access control is [http://world.std.com/~cme/spki.txt SPKI].

	==Concurrency==		==Concurrency==

217.231.184.241: /* Access Control Lists */

2004-12-29T17:14:23Z

Access Control Lists

← Older revision		Revision as of 17:14, 29 December 2004
Line 53:		Line 53:
	All described models are		All described models are
	==== Access Control Lists ====		==== Access Control Lists ====
			==== Capability-based Authorization ====
			==== Credential-based Authorization ====

	==Concurrency==		==Concurrency==

217.231.184.241: /* Distributed Access Control */

2004-12-29T17:13:16Z

Distributed Access Control

← Older revision		Revision as of 17:13, 29 December 2004
Line 35:		Line 35:
	fault tolerance research, which will lead us to the concept of intrusion tolerance.		fault tolerance research, which will lead us to the concept of intrusion tolerance.

			==Distributed Access Control==
	==Trust==
			Access control refers to the restriction of access to facilities, property, information, ressources etc.
			Access control is traditionally divided into 2 subtasks, (1) authentication and (2) authorization. (1) deals with identification. It is about knowing if the process or user trying to get access is infact the process or user it is claiming to be. The second task is responsible for granting access to the requested ressource or information.


			=== Access Control Models ===
			Access control models are sets of formalized, concise security goals and properties, as well as methods for enforcing them. There are a number of well known access control models, which usually have strong root in the domain they are applied to. A lot of the research done in this area is not primarly rooted in distributed systems, so going from the formal models approaches will be searched that are suitable for the specific tasks and requirements of distributed systems.

			==== Mandatory Access Control (MAC) ====
			MAC restricts access to objects on the basis of sensitivity and clearance. Sensitivity is usually represented by a label on the object. Clearance is an information about the principal requesting access. It involves formal authorization. MAC is the fundamental model for military access control. [http://en.wikipedia.org/wiki/Mandatory_access_control (MAC)]
			==== Discretionary Access Control (DAC) ====
			The fundamental term in the access control model is "owner". The owner of an object is fully trusted to manage its security. Owners have or can aquire all rights to their objects. Furthermore owners may grant or deny access to groups or others. DAC is the model behind rights management in the unix world. [http://en.wikipedia.org/wiki/Discretionary_access_control (DAC)]
			==== Role Based Access Control (RBAC) ====
			Roles reflect organizational functions. Access rights are granted on the basis of roles. Principals aquire roles and therefor access rights. [http://en.wikipedia.org/wiki/RBAC (RBAC)]

			=== Distributed Authorization ===
			All described models are
			==== Access Control Lists ====

	==Concurrency==		==Concurrency==

217.231.184.241: /* Introduction */

2004-12-29T16:32:29Z

Introduction

← Older revision		Revision as of 16:32, 29 December 2004
Line 27:		Line 27:
	In combination with the characteristics mentioned above, these result in several topical		In combination with the characteristics mentioned above, these result in several topical
	areas for security.		areas for security.
	First, distributing a system's components strengthens the importance of ~~trust~~ ~~relations~~		First, distributing a system's components strengthens the importance of access control. While access control in systems that are confined to single locations and specified groups of users is already a problem it becomes an almost unsolvable problem when involving magnitudes of locations, different persons in charge, unknown user groups.
		⚫	Consequently, we will focus on distributed access control in the first section of the following text.
	between components and of the system as a whole regarding its interactions with the
	environment.
⚫	Consequently, we will focus on ~~trust~~ in the first section of the following text.
	Service requirements are the second field we will take a look at; here, our main aim		Service requirements are the second field we will take a look at; here, our main aim
	will be outlining the implications of concurrency.		will be outlining the implications of concurrency.