The paper considers how security protocols are as they are in part because of the hardware environment in which they are expected to function. Expectations were set nearly twenty years ago, when communications were very unreliable and slow, when reliable sources of time were most unusual, when encryption was extremely slow, when memories and disks were small and slow. In consequence protocol designers went to great lengths to minimise the number of messages sent and their size, particularly the size of the encrypted part. It was considered very undesirable to rely on time other than very locally for ordinal purposes, and systems were expected as far as possible to be stateless.

The author looks at the development of BAN logic, and with hindsight, considers the oversimplifications that were made.

We present principles for designing cryptographic protocols. The principles are neither necessary nor sufficient for correctness. They are however helpful, in that adherence to them would have prevented a number of published errors. Our principles are informal guidelines; they complement formal methods, but do not assume them. In order to demonstrate the actual applicability of these guidelines, we discuss some instructive examples from the literature.

We present principles for the design of cryptographic protocols. The principles are neither necessary nor sufficient for correctness. They are however helpful, in that adherence to them would have avoided a considerable number of published errors. Our principles are informal guidelines. They complement formal methods, but do not assume them. In order to demonstrate the actual applicability of these guidelines, we discuss some instructive examples from the literature.

The contractor uses the client, the network, and the server to give a service to the customer. We put it this way to emphasise that the denial of service against which we seek to protect is the denial of service to the customer, not to the client. The attack may indeed consist of disabling or destroying the client, just as it may consist of interfering with the network or with the server. This paper does not consider issues of responsibility.

In a security system that allows people to choose their own passwords, people tend to choose passwords that can be easily guessed. This weakness exists in practically all widely used systems. Instead of forcing users to choose secrets that are likely to be difficult for them to remember, solutions that maintain user convenience and a high level of security at the same time are proposed. The basic idea is to ensure that data available to the attacker is sufficiently unpredictable to prevent an offline verification of whether a guess is successful or not. Common forms of guessing attacks are examined, examples of cryptographic protocols that are immune to such attacks are developed, and a systematic way to examine protocols to detect vulnerabilities to such attacks is suggested.>

Autonet is a self-configuring local area network composed of switches interconnected by 100 Mb/s, full-duplex, point-to-point links. The switches contain 12 ports that are internally connected by a full crossbar. Switches use cut-through to achieve a packet forwarding latency as low as 2 ms/switch. Any switch port can be cabled to any other switch port or to a host network controller. A processor in each switch monitors the network's physical configuration. A distributed algorithm running on the switch processor computes the routes packets are to follow and fills in the packet forwarding table in each switch. With Autonet, distinct paths through the set of network links can carry packets in parallel, allowing many pairs of hosts to communicate simultaneously at full link bandwidth. A 30-switch network with more than 100 hosts has been the service network for Digital's Systems Research Center since February 1990.>

A mechanism is presented for reasoning about belief as a systematic way to understand the working of cryptographic protocols. The mechanism captures more features of such protocols than that given by M. Burrows et al. (1989) to which the proposals are a substantial extension. The notion of possession incorporated in the approach assumes that principles can include in messages data they do not believe in, but merely possess. This also enables conclusions such as 'Q possesses the shared key', as in an example to be derived. The approach places a strong emphasis on the separation between the content and the meaning of messages. This can increase consistency in the analysis and, more importantly, introduce the ability to reason at more than one level. The final position in a given run will depend on the level of mutual trust of the specified principles participating in that run.>

Authentication protocols are the basis of security in many distributed systems, and it is therefore essential to ensure that these protocols function correctly. Unfortunately, their design has been extremely error prone. Most of the protocols found in the literature contain redundancies or security flaws. A simple logic has allowed us to describe the beliefs of trustworthy parties involved in authentication protocols and the evolution of these beliefs as a consequence of communication. We have been able to explain a variety of authentication protocols formally, to discover subtleties and errors in them, and to suggest improvements. In this paper we present the logic and then give the results of our analysis of four published protocols, chosen either because of their practical importance or because they serve to illustrate our method.

Authentication protocols are the basis of security in many distributed systems, and it is therefore essential to ensure that these protocols function correctly. Unfortunately, their design has been extremely error prone. Most of the protocols found in the literature contain redundancies or security flaws.

It is well-known that, left to themselves, people will choose passwords that can be rather readily guessed. If this is done, they are usually vulnerable to an attack based on copying the content of messages forming part of an authentication protocol and experimenting, e.g. with a dictionary, offline. The most usual counter to this threat is to require people to use passwords which are obscure, or even to insist on the system choosing their passwords for them. In this paper we show alternatively how to construct an authentication protocol in which offline experimentation is impracticable; any attack based on experiment must involve the real authentication server and is thus open to detection by the server noticing multiple attempts.

A discussion is presented of the choices facing a designer as faster speeds for local area networks are contemplated. The 100-Mb/s Cambridge fast ring (CFR) is described. The ring protocol allows one of a number of fixed-size slots to be used once or repeatedly. The network design allows sets of rings to be constructed by pushing the bridge function to the lowest hardware level. Low cost and ease of use is normally achieved by design of special chips; two-chip VLSI implementation is described. This VLSI hardware forms the basis of a kit of parts from which many different network components can be constructed.>

This paper describes a design for an authentication service for a very large scale, very long lifetime, distributed system. The paper introduces a methodology for describing authentication protocols that makes explicit the trust relationships amongst the participants. The authentication protocol is based on the primitive notion of composition of secure channels. The authentication model offered provides for the authentication of "roles", where a principal might exercise differing roles at differing times, whilst having only a single "identity". Roles are suitable for inclusion in access control lists. The naming of a role implies what entities are being trusted to authenticate the role. We provide a UID scheme that gives clients control over the time at which a name gets bound to a principal, thus controlling the effects of mutability of the name space.

Article Free Access Share on A caching file system for a programmer's workstation Authors: Michael D. Schroeder DEC Systems Research Center, Xerox Palo Alto Research Center, 130 Lytton Ave., Palo Alto, CA DEC Systems Research Center, Xerox Palo Alto Research Center, 130 Lytton Ave., Palo Alto, CAView Profile , David K. Gifford Laboratory for Computer Science, Xerox Palo Alto Research Center, 545 Technology Sq., Cambridge, MA Laboratory for Computer Science, Xerox Palo Alto Research Center, 545 Technology Sq., Cambridge, MAView Profile , Roger M. Needham Computer Laboratory, Xerox Palo Alto Research Center, Corn Exchange St., Cambridge CB2 3QG, UK Computer Laboratory, Xerox Palo Alto Research Center, Corn Exchange St., Cambridge CB2 3QG, UKView Profile Authors Info & Claims SOSP '85: Proceedings of the tenth ACM symposium on Operating systems principlesDecember 1985 Pages 25–34https://doi.org/10.1145/323647.323632Published:01 December 1985Publication History 86citation361DownloadsMetricsTotal Citations86Total Downloads361Last 12 Months63Last 6 weeks6 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Grapevine is a distributed, replicated system that provides message delivery, naming, authentication, resource location, and access control services in an internet of computers.The system, described in a previous paper [1], was designed and implemented several years ago.We now have had operational experience with the system under substantial load.In this paper we report on what we have learned from using Grapevine.

This paper discusses an experiment which sets out to improve the performance of a number of single user computers which rely on a general purpose file server for their filing systems. The background is described in detail in reference [1], but for completeness it is necessary to say something about it here.

Grapevine is a distributed, replicated system that provides message delivery, naming, authentication, resource location, and access control services in an internet of computers. The system, described in a previous paper [1], was designed and implemented several years ago. We now have had operational experience with the system under substantial load. This experience has proved the original design sound in most aspects, but there also have been some surprises. In this paper we report what we have learned from using Grapevine. Our experience may offer some help to designers of new systems.

It is sometimes necessary in the course of a distributed computation to arrange that a certain set of operations is carried out in the correct order and the correct number of times (typically once). If several sets of operations are performed on different machines on the network there is no obvious mechanism for enforcing such ordering constraints in a fully distributed way. This lack basically stems from the difficulty of preventing copying and repetition of messages by machines and from the impossibility of constraining externally the actions of machines in response to messages that come into their hands.

A file server is a utility provided in a computer connected via a local communications network to a number of other computer. File servers exist to preserve material for the benefit of client machines or systems. It is desirable for a file server to be able to support multiple file directory and access management systems, so that the designer of a client system retains the freedom to design the system that best suits him. For example, he may wish to use the rile server to support a predefimed directory structure or as a swapping disk. The paper explores the dedgn issues associated with such a file server and proposes some solutions.

The Cambridge Ring is a local communication system developed in the Computer Laboratory of the University of Cambridge. It differs in various respects from some other local communication mechanisms such as Ethernet systems (Metcalfe & Boggs, 1976), and the purpose of the present paper is to describe the way in which the properties of the ring affect the general systems aspects of its exploitation.

The CAP project has included the design and construction of a computer with an unusual and very detailed structure of memory protection, and subsequently the development of an operating system which fully exploits the protection facilities. The present paper passes the work in review and draws conclusions about good and bad aspects of the system. The basic architecture of the CAP machine is described in [1] and a largely prospective description of the protection system is given in [2].

The filing system for the CAP is based on the idea of preservation of capabilities: if a program has been able to obtain some capability then it has an absolute right to preserve it for subsequent use. The pursuit of this principle, using capability-oriented mechanisms in preference to access control lists, has led to a filing system in which a preserved capability may be retrieved from different directories to achieve different access statuses, in which the significance of a text name depends on the directory to which it is presented, and in which filing system 'privilege' is expressed by possession of directory capabilities.

This paper gives an outline of the architecture of the CAP computer as it concerns capability-based protection and then gives an account of how protected procedures are used in the construction of an operating system.

The design of a system for process management on a given computer must take into account the facilities built into the hardware for memory protection. The problems arising are discussed from the point of view of the Cambridge CAP system now under development.

It is commonplace to build facilities into operating systems to handle faults which occur in user-level programs. These facilities are often inadequate for their task; some faults or incidents are regarded as so bad that the user cannot be allowed to act on them and this makes it difficult or impossible to write subsystems which give proper diagnostics in all cases, or which are adequately secure, or which are adequately robust. This paper looks into why there is a need for very complete facilities and why there is a problem about providing them, and proposes an outline structure which could be used.

Abstract Testing and development of elaborate systems requires the assistance of sophisticated techniques and software aids at several stages in the process. These include systems for managing and manipulating the source text, producing and testing new versions in a realistic but ‘safe’ environment and arranging for easy and compatible fall back to a previous version in case of unforeseen difficulties. The paper describes a number of such aids that have been found useful during the development of the Cambridge Multiple‐Access system.

In designing an operating system one needs both theoretical insight and horse sense. Without the former, one designs an ad hoc mess; without the latter one designs an elephant in best Carrara marble (white, perfect, and immobile). We try in this paper to explore the provinces of the two needs, suggesting places where we think horse sense will always be needed, and some other places where better theoretical understanding than we now have would seem both possible and helpful.

The paper discusses the basic logic of the supervisor which has been developed for the Titan computer at the Mathematical Laboratory, Cambridge University. The emphasis is on the underlying principles rather than the operating system as seen by the user.

In a previous paper, one of the authors discussed some of the hardware and software problems facing the designer of a multiple-access computer system. The present paper carries the discussion further and surveys certain areas of system design that are at present far from being well understood. In particular the problem of communication between processes in a multi-computer configuration is discussed. The authors offer no final solutions, but endeavour to set in perspective some of the problems that must be solved before highly efficient multiple-access systems can be designed.

Automatic Language Translation A. G. Oettinger (Harvard ), 380, price not given.

Automatic Translation D. Yu. Panov (Pergamon ), 73, 21s.