1. Issues Relevant To Distributed Security CSC 8320 Nidhi Gahlot

2. OUTLINE Security in Distributed Systems Popular Security Mechanism in Distributed Systems Protection Methods Against Security Threats Complex Security Policies – Multilevel Information Flow exceptions – Redefining Flow Exceptions in Terms of Access Control Concept of Proxy – Advantages of Proxy Covert channels Traffic analysis prevention

3. Security in Distributed Systems[1] Different from operating system security: – No central trusted authority that mediates interaction between users and processes. – Distributed system runs on top of a large number of loosely coupled autonomous hosts, that maybe running different OS’s with possibly different security policies. So, issue of security becomes even more complex in Distributed Systems.

4. Popular Security Mechanism in Distributed Systems [1] Two Key Terms – Objects, example:- a file – Subjects, example:- a user The General Security Scheme is: – to provide mechanisms for the location, migration, persistence as well as Remote Method Invocation of objects by subjects. Examples of systems which use this paradigm CORBA, DCOM

5. Protection Methods Against Security Threats [2] Authentication – Allows only authentic subjects to have access to the system. Authorization – Allows an object access only to authorized subjects. Auditing – Process of maintaining an audit log which records all activity. This helps in tracing security attacks.

6. Complex Security policies - extension to authentication[2] Access Control Matrices These are stateless.

7. …..Complex Security policies[2] Complex access control policies have state dependent security requirements. Example:- A security policy which decides its course by reading the subject’s past access history: – A subject S is not allowed to access object O1 if it has read object O2. “If” is the keyword here which makes the security policies in distributed systems state dependent.

8. Multilevel Information Flow Exceptions[2] Information flow model: – lattice structure in which information can flow in the direction the properties used to construct the lattice permit. But, In Distributed Systems, – There are some applications which need information flow which violates some properties of lattice. – These are called information flow exceptions.

9. ….. Multilevel Information Flow Exceptions[2] There are 3 types of information flow exceptions: Transitivity Exception Aggregation exception Separation Exception.

10. Redefining flow exceptions in terms of Access Control[2] Main operations between entities in access control are: – Read, & – Write. So, A→ B means A writes information to object B.

11. ……Redefining flow exceptions in terms of Access Control[2]

12. Proxy and its use[2][3] Definition: – A “Proxy” is a certificate which verifies that a subject has truly given a subset of its rights to another subject for performing some tasks on its behalf. Usage example: – A client process makes a request to a print server to print a file. – The client can make the print server its proxy.

13. Advantages of Proxy[2][3] Amount of file transfer in the network is reduced. Client does not have to wait for print server even if it does not have sufficient buffer space for the file at the time of the request. So, the delegation of responsibilities to proxies improves the efficiency of processing.

14. Covert Channels[2][4] Definition:- – A communication path that conveys information illegitimately by seemingly legitimate use of computer resources. Maybe intentional or unintentional Traditionally, categories of covert channels: – Storage channels – Timing channels Network covert channels

15. Traffic Analysis Prevention[2] The key is to regulate information flow in the network such that the spatial and temporal imparity of the network traffic pattern is reduced. Common approaches:- – Encryption – Padding – Routing – Scheduling

16. REFERENCES [1]. Feng, Fujun; Lin, Chuang; Peng, Dongsheng; Li, Junshan. “A Trust and Context Based Access Control Model for Distributed Systems” High Performance Computing and Communications, 2008. HPCC '08. 10th IEEE International Conference on 25-27 Sept. 2008 Page(s):629 – 634 High Performance Computing and Communications, 2008. HPCC '08. 10th IEEE International Conference on [2]. Distributed Operating Systems & Algorithms, Randy Chow and Theodore Johnson, Addison Wesley, 1997. [3]. Dave, A.; Sefika, M.; Campbell, R.H.; “ Proxies, application interfaces, and distributed system” Object Orientation in Operating Systems, 1992., Proceedings of the Second International Workshop on 24-25 Sept. 1992 Page(s):212 - 220 Object Orientation in Operating Systems, 1992., Proceedings of the Second International Workshop on [4]. http://en.wikipedia.org/wiki/Covert_channels,http://en.wikipedia.org/wiki/Covert_channels 1 Nov.,2008