A policy for propagation of authentication trust across realm boundaries is defined and rationalized. This policy helps limit global security exposures that ensue whenever an authentication service is compromised. The policy is based on a hierarchical model of inter-realm authentication and can be supported by both public key and secret key systems. As an example, a simple protocol which selects inter-realm authentication paths that satisfy the policy are presented. The protocol is part of a design which provides application transparency for inter-realm authentication path selection and acceptance as the default mode of operation. This design can be integrated with the security services of existing systems; e.g., of the Open Software Foundation's Distributed Computing Environment (DCE). DCE implementation issues are also discussed.>

Various approaches to the problem of replay detection in distributed systems are briefly reviewed. An approach based on combining a variable-size time-window mechanism with a challenge mechanism is proposed. This approach has the following properties: (1) it does not depend on clock synchronization, (2) it allows the setting of a minimum server's memory-buffer size in a way that ensures acceptance of all legitimate client requests and (3) it is robust without requiring stable (nonvolatile) memory for the server buffer needed to save past client requests.>

A general protocol for atomic broadcast in networks is presented. The protocol tolerates loss, duplication, reordering, delay of messages, and network partitioning in an arbitrary network of fail-stop sites (i.e. no Byzantine site behavior is tolerated). The protocol is based on majority-concensus decisions to commit on unique ordering of received broadcast messages. Under normal operating conditions, the protocol requires three phases to complete and approximately 4N/V messages where N is the number of sites. This overhead is distributed among the messages of which the delivery decision is made and the heavier the broadcast message traffic, the lower the overhead per broadcast message becomes. Under abnormal operating conditions, a decentralized termination protocol (also presented) is invoked. A performance analysis of this protocol is presented, showing that this protocol commits with high probability under realistic operating conditions without invoking termination protocol if N is sufficiently large. The protocol retains its efficiency in wide-area networks where broadcast communication media are unavailable.>

A novel general protocol for atomic broadcast in networks is presented. The protocol tolerates loss, duplication, reordering, delay of messages, and network partitioning in an arbitrary network of 'fail-stop' sites (i.e. no Byzantine site behavior is tolerated). The protocol is fully decentralized and is based on majority-consensus decisions to commit on unique ordering of received broadcast messages. Under normal operating conditions, the protocol requires three phases to complete and approximately 4N messages where N is the number of sites. If more than 4N broadcast messages are exchanged in each protocol execution, this protocol achieves better performance than any of the protocols published to date without assuming specific types of site connectivity, clock synchronization, or knowledge of failed sites and failed communication links. Under abnormal operating conditions, a decentralized termination protocol, also presented, is invoked. A performance analysis of this protocol shows that it commits with high probability under realistic operating conditions without invoking termination protocol if N is sufficiently large.>