Computer Security Distributed System Security 11/28/2018

Distributed System Security Objectives Appreciate the security problems in distributed systems Examine which system layer is best suited for implementing security Analyze the security mechanisms currently used in distributed systems. 11/28/2018

Distributed System Security Introduction Moving from a centralized system to a distributed system has a major impact on security. It is essential to understand the implicit assumptions that underpin the security in a centralized system. 11/28/2018

Security Policies Users are not necessarily registered at the node they are accessing an object. How do you authenticate a user? Based on: the user identity The network address the user operates from What is the basis for access control mechanisms Based on The distributed service the user invokes (the access operation). 11/28/2018

Security Policies Unix takes the user identity approach for remote access services such as: ftp or telnet, rlogin telnet and rlogin create a remote virtual terminal. There are several major vulnerabilities with this approach. How will users access rights travel? 11/28/2018

Security Policies Example: You send a read request for data held at a remote server. The server writes the data to an output channel connecting back to you. Which access rules should the server apply: those for read access or those for write access? You may decide that users coming from certain “trusted” nodes need not be authenticated again. In Unix trusted hosts can be specified in the .rhosts file And trusted users in the rsh (remote shell) command 11/28/2018

Security Policies The trust relationships in Windows NT provide a more sophisticated for giving users in a trusted domain access to resources in a trusting domain. One way trust relationship trusted domain trusting domain User accounts from the trusted domain are valid in the trusting domain. 11/28/2018

Security Policies We also have two-way or more trust relationships. However it is important to note that trust is not transitive! A trust relationship is set up as follows: An administrator sets up an interdomain trust account specifying the name of the trusted domain and a password for this domain. 11/28/2018

Security Policies A trust relationship is set up as follows: An administrator sets up an interdomain trust account specifying the name of the trusted domain and a password for this domain. The password is given to the trusting domain. The Local Security Authority (LSA) in the trusting domain creates a trusted domain object, containing the name and SID of the trusted domain, and a secret object, containing the password received. 11/28/2018

Delegation In distributed systems controlled invocation takes on a new dimension. A user may login at a local node and execute a program on a remote node. To obtain access to resources the program will need the relevant access rights. Typically the program is endowed with the access rights of the user and runs with the access rights on the remote host. 11/28/2018

Delegation So the program is running with the access rights delegated by the user. Users may not feel too comfortable about releasing their rights to an unknown host! For example, if there is weak protection on the remote host, an attacker may grab the users access right and use it for an illicit purpose. For popular services one can create a proxy users to deal with remote service requests. 11/28/2018

Security enforced Once policies are sorted out, these must be enforced Where do you authenticate the user? Where do you make an access control decision? There are several possible approaches: Use a Kerberos type mechanism with An authentication server and Ticket granting servers Install a firewall to control access to an internal network. 11/28/2018

Authentication Unprotected passwords transmitted over public networks are an obvious vulnerability. We shall consider two security enforcement schemes: A central security enforcement scheme: Kerberos A local security enforcement scheme: DSSA/SPX 11/28/2018

A central security enforcement scheme Kerberos Authentication is based on two basic concepts: tickets and security servers. Kerberos authentication server (KAS): Authenticates principals at login and issues tickets which are valid for one login session and enable principals to obtain other tickets from ticket-granting servers. Ticket granting servers (TGS): Issue tickets that give principals access to network services. 11/28/2018

Kerberos TGS KAS A B A,TGS,L1,N1 eKa(TGS,Ka,tgs,Ticketa,tgs,L1,N1) 3 4 2 5 KAS A B 1 6 A,TGS,L1,N1 eKa(TGS,Ka,tgs,Ticketa,tgs,L1,N1) A,B, L2,N2 ,Ticketa,tgs, eKa,tgs(A,T3) eKa,tgs(B,Ka,b,Ticketa,b,L2,N2) eKa,b(A,T4),Ticketa,b eKa,b(T4) Ticketa,tgs= eKtgs(Ka,tgs,A,T1,L1) Ticketa,b = eKb(Ka,b,A,T2,L2) 11/28/2018

Kerberos Remarks: In the basic Kerberos scheme the session keys are symmetric. The encryption keys Ka (or Kb) can be symmetric, or alternatively Public Encryption Keys may be used. Revocation: The KAS and TGS update their access rights database. 11/28/2018