Abstract
With reference to a distributed system consisting of nodes connected by a local area network, we consider a salient aspect of the protection problem, the representation of access permissions and protection domains. We present a model of a protection system supporting typed objects. Possession of an access permission for a given object is certified by possession of an object pointer including the specification of a set of access rights. We associate an encryption key with each object and a password with each domain. Object pointers are stored in memory in a ciphertext form obtained by using the object key and including the value of the domain password. Each process is executed in a domain and can take advantage of a given object pointer only if this object pointer was encrypted by including the password of this domain. A set of protection primitives makes it possible to use object pointers for object reference and to control the movements of the objects across the network. The resulting protection environment is evaluated from a number of salient viewpoints, including ease of access right distribution and revocation, interprocess interaction and cooperation, protection against fraudulent actions of access right manipulation and stealing, storage overhead, and network traffic.
1. Introduction
We shall refer to a distributed architecture consisting of nodes connected by a local area network. We make no hypothesis concerning the network topology. Collectively, the network nodes support a common pool of typed objects, which are the elementary units of information movement across the network. Beside a processor, each node features memory resources for object storage.
In an environment of this type, we shall present a model of a protection system that assigns a protection domain to every given process; this is a collection of access permissions for the existing objects [15,16]. The salient aspects of the protection problem are related to the representation in memory of access permissions and protection domains. The protection system defines mechanisms that allow a process being executed in a given domain to certify the access permissions it holds within the context of that domain. Furthermore, the process is prevented from manipulating the composition of the domain, to add new access permissions, for instance. Forms of interprocess cooperation are supported, so that a process may grant an access permission in its own domain to a different process.
5. Concluding remarks
With reference to a distributed system consisting of nodes connected by a local area network, we have considered a salient aspect of the protection problem, the representation of access permissions and protection domains. We have presented a model of a protection system that is based on the application of techniques of symmetric-key cryptography. We have obtained the following results.
• O-pointers can be freely mixed in memory with ordinary data items. It is practically impossible to forge a valid o-pointer for an existing object. These results have been obtained by taking advantage of cryptography without incurring the hardware costs connected with memory tagging, while maintaining the simplicity and effectiveness of access right distribution.
