From Coulouris, Dollimore, Kindberg and Blair Distributed Systems: Concepts and Design Edition 5, © Addison-Wesley 2012 Slides for Chapter 11: Security

Security techniques(cont.) Access control: Control of access to resources of a server. the server receives request message of the form:, where:  op :the requested operation,  principal :an identity or a set of credentials for the principal making the request.  resource : identifies the resource to which the operation is to be applied 2

Security techniques(cont.) In object-oriented distributed systems there may be many types of object to which access control must be applied, For example, Alice may be allowed only one cash withdrawal from her bank account per day, while Bob is allowed three. (because of different bank strategies) 3

Security techniques(cont.) Credentials: Are a set of evidence provided by a principal when requesting access to a resource. It is not convenient to require users to interact with the system and authenticate themselves each time their authority is required to perform an operation. Instead, a user’s public-key certificate speaks for that user – any process receiving a request authenticated with the user’s private key can assume that the request was issued by that user. 4

Security techniques(cont.) Firewalls: They protect intranets, performing filtering actions on incoming and outgoing communications Firewalls produce a local communication environment in which all external communication is intercepted. Messages are forwarded to the intended local recipient only for communications that are explicitly authorized. Firewalls is not effective in: Control public services on the Internet Attacks from inside an organization (external access may happen) Denial-of-service attacks (attempt to make a machine or network resource unavailable to its intended users) 5

Cryptographic algorithms A message is encrypted by the sender applying some rule to transform the plain text message (any sequence of bits) to a ciphertext (a different sequence of bits). The recipient must know the inverse rule in order to transform the ciphertext back into the original plaintext. The encryption transformation is defined with two parts, a function E and a key K. The resulting encrypted message is written {M} k E(K,M) = {M} k 6

Cryptographic algorithms Decryption: D(K,E(K,M)) = M For secret-key encryption, the key used for decryption is the same as that used for encryption (symmetric cryptography) public-key cryptography (different keys used ) is referred to as (asymmetric) 7

Cryptographic algorithms 1) Block ciphers A message is subdivided into blocks, and each block is encrypted independently. The first block is available for transmission as soon as it has been encrypted.  Cipher block chaining: Each plaintext block is combined with the preceding ciphertext block using the exclusive-or operation (XOR) before it is encrypted. On decryption, the block is decrypted and then the preceding encrypted block (which should have been stored for this purpose) is XOR-ed with it to obtain the new plaintext block. 8

Instructor’s Guide for Coulouris, Dollimore, Kindberg and Blair, Distributed Systems: Concepts and Design Edn. 5 © Pearson Education 2012 Figure 11.5 Cipher block chaining n n+3n+2n+1 XOR E(K, M) n-1n-2 n-3 plaintext blocks ciphertext blocks

Cryptographic algorithms 2)Stream ciphers A keystream is an arbitrary-length sequence of bits that can be used to secure the contents of a data stream by XOR-ing the keystream with the data stream 10

Instructor’s Guide for Coulouris, Dollimore, Kindberg and Blair, Distributed Systems: Concepts and Design Edn. 5 © Pearson Education 2012 Figure 11.6 Stream cipher XOR E(K, M) number generator n+3n+2n+1 plaintext stream ciphertext stream buffer keystream