Electronic transactions regularly occur between business partners in separate security domains. Trust negotiation is an approach that provides an open authentication and access-control environment for such transactions, but it is vulnerable to malicious attacks leading to denial of service or leakage of sensitive information. This paper introduces an Adaptive Trust Negotiation and Access Control (ATNAC) framework to solve these problems. The framework combines two existing systems, TrustBuilder and GAA-API, to create a system with more flexibility and responsiveness to attack than either system currently provides.

The goal of the work described in this paper was to build a flexible framework for different replication mechanisms in distributed systems that would be suitable for a wide variety of users and applications. A framework was developed that supports multiple replication mechanisms, allows different objects to be maintained with different replication mechanisms, and enables application programmers to provide their own replication mechanisms. It will be argued that this framework allowed the needs of diverse users and applications in large distributed systems to be met. Our work has produced two significant contributions. First, after an examination of replication mechanisms used in distributed systems, a flexible framework that supports multiple replication mechanisms together was designed and developed. Second, following an examination of different levels of replication between replicas, a unified framework for them was produced. This multi-level replication allows the framework to work well with mobile computing by placing different replicas on mobile sites.

We present a practical and efficient garbage collection mechanism for large scale distributed systems. The mechanism collects all garbage including distributed cyclic garbage without global synchronization or backward links. The primary method used for local and remote garbage collection is timeouts: each object has a time-to-live, and clients which have a link to an object must refresh the target object within the time-to-live to guarantee that the link will remain valid. For cyclic garbage collection: objects suspected to be garbage are detected by last referenceable timestamp propagation; and cyclic garbage is reclaimed by backward inquiry (back-tracing). Since, without additional overhead, the information about backward references can be obtained during the refreshing process, and since messages necessary for cyclic garbage collection are bundled with the messages used for the refreshing, communication, computation and storage overhead is minimized. This mechanism has been implemented and evaluated on Prospero directory service, and the performance results show that it works well for large scale distributed systems.

Current intrusion detection systems work in isolation front access control for the application the systems aim to protect. The lack of coordination and inter-operation between these components prevents detecting and responding to ongoing attacks in real time, before they cause damage. To address this, we apply dynamic authorization techniques to support fine-grained access control and application level intrusion detection and response capabilities. This paper describes our experience with integration of the Generic Authorization and Access Control API (GAA-API) to provide dynamic intrusion detection and response for the Apache Web Server The GAA-API is a generic interface which may be used to enable such dynamic authorization and intrusion response capabilities for many applications.

Current intrusion detection systems work in isolation from access control for the application the systems aim to protect. The lack of coordination and interoperation between these components prevents detecting and responding to ongoing attacks in real-time before they cause damage. To address this, we apply dynamic authorization techniques to support fine-grained access control and application level intrusion detection and response capabilities. This paper describes our experience with integration of the Generic Authorization and Access Control API (GAA-API) to provide dynamic intrusion detection and response for the Apache Web server. The GAA-API is a generic interface which may be used to enable such dynamic authorization and intrusion response capabilities for many applications.

This paper studies the behavior of ARDP, a request response transport protocol, when operating in a shared communication infrastructure like the Internet. Our experiments demonstrate that ARDP backs off in the presence of congestion, yet tries to take advantage of available bandwidth. We also show that ARDP is well-behaved when competing for network resources with TCP.

One of the most difficult problems to be solved by metacomputing systems is to ensure strong authentication and authorization. The problem is complicated since the hosts involved in a metacomputing environment often span multiple administrative domains, each with its own security policy. This paper presents a distributed authorization model used by our resource allocation system, the Prospero resource manager. The main components of our design are extended access control lists (EACLs) and a general authorization and access application programming interface (GAA API). EACLs extend conventional ACLs to allow conditional restrictions on access rights. In the case of the Prospero resource manager, specific restrictions include limits on the computational resources to be consumed and on the characteristics of the applications to be executed by the system, such as name, version or endorser. The GAA API provides a general framework for applications to access the EACLs. We have built a prototype of the system.

While there has been considerable effort in creating a single sign-on solution for interoperability among authentication methods, such interoperability across authorization methods has received little attention. This paper presents a flexible distributed authorization protocol that provides the full generality of restricted proxies while supporting the functionality of and interoperability with existing authorization models including OSF DCE and SESAME V2. Our authorization protocol includes a delegation method that is well suited for certain electronic commerce applications.

As the Internet is used to a greater extent in business, issues of protection and privacy will have more importance. Users and organizations must have the ability to control reads and writes to network accessible information, they must be assured of the integrity and confidentiality of the information accessed over the net, and they must have a means to determine the security, competence, and honesty of the commercial service providers with which they interact. They must also be able to pay for purchases made on the network, and they should be free from excessive monitoring of their activities. This paper discusses characteristics of the Internet that make it difficult to provide such assurances and surveys some of the techniques that can used to protect users of the network.>

Clients in a distributed system place their confidence in many servers, and servers themselves rely on other servers for file storage, authentication, authorization, and payment. When a system spans administrative boundaries it becomes harder to assess the security and competence of potential service providers. This paper examines the issue of confidence in large distributed systems.

Abstract Existing techniques for allocating processors in parallel and distributed systems are not suitable for use in large distributed systems. In such systems, dedicated multiprocessors should exist as an integral component of the distributed system, and idle processors should be available to applications that need them. The Prospero Resource Manager (PRM) is a scalable resource allocation system that supports the allocation of processing resources in large networks and on multiprocessor systems. PRM employs three types of managers‐the job manager, the system manager and the node manager‐to manage resources in a distributed system. Multiple independent instances of each type of manager exist, reducing bottlenecks. When making scheduling decisions each manager utilizes information most closely associated with the entities for which it is responsible.

Licensing is a topic of increasing importance for software publishers and users. More and more, the magnitude of financial transfers between these two partners are determined by some electronic licensing service being part of the system on which the licensed software is running. In order to ease the use and management of such licensing schemes and to enable economic software usage in enterprise-wide computer systems through flexible and fair billing structures, various organizations are working on formulating requirements, defining architectures, and building standard interfaces for so called license brokerage systems. The trustworthiness of these services is essential because large amounts of money can depend on them. Most of these licensing services are currently operating independently of access control and rely on proprietary and unpublished security algorithms. This paper proposes an extension of access control to integrate licensing called Stateful Access Control and it addresses some aspects of virus protection.

Multiprocessor systems should exist in the larger context of distributed systems, allowing multiprocessor resources to be shared by those that need them. Unfortunately, typical multiprocessor resource management techniques do not scale to large networks. The Prospero Resource Manager (PRM) is a scalable resource allocation system that supports the allocation of processing resources in large networks and multiprocessor systems. To manage resources in such distributed parallel systems, PRM employs three types of managers: system managers, job managers, and node managers. There exist multiple independent instances of each type of manager, reducing bottlenecks. The complexity of each manager is further reduced because each is designed to utilize information at an appropriate level of abstraction.>

A unified model is presented for authentication, authorization, and accounting that is based on proxies. It is shown that the proxy model for authorization can be used to support a wide range of authorization and accounting mechanisms. The proxy model strikes a balance between access-control-list anti capability-based mechanisms, allowing each to be used where appropriate and allowing their use in combination. The author describes how restricted proxies can be supported using existing authentication methods.>