Four distributed query processing strategies under consideration for incorporation into the Cronus object-oriented distributed computing environment are described. Under Cronus, object storage can be embedded inside applications, and facilities are provided to distribute and replicate automatically the data maintained by the application. The performance of the query processing strategies is analyzed within this environment. The resulting evaluation points out the factors to consider in developing query processing strategies for replicated, object-oriented data, and the impact of those factors on the cost and optimality of the strategies. The evaluation led to the adoption of an optimistic, decentralized strategy which increases parallelism and decreases the size of messages at the expense of an increase in the number of messages transferred.>

Some issues in distributed system security are discussed in the context of the design of a secure distributed operating system (SDOS). The design is targeted for an A1 rating. Some developments in formal verification methods are reported. Distributed system security is contrasted with single-host and network security, and described in the context of the Trusted Network Interpretation. Problems unique to distributed system security are discussed. An argument is made for implementing security features in higher layers, corresponding roughly to the session through application layers of the OSI model. A security policy based on message-passing rather than reads and writes is described. The SDOS design is summarized.>

A discretionary access control mechanism proposed for a secure distributed operating system (DOS) being designed at BBN Laboratories is presented. The DOS is an object-oriented system that uses access control lists to authorize access to objects. Discretionary controls are implemented in a type-specific manner inside the managers of objects. Several extensions to conventional access control lists are proposed, including a limited form of privilege transfer, module interconnection control, support for direct operations roles, and restricted roles. A technique for automatically generating access control implementations is presented that is based on nonprocedural specifications, and an implementation approach is proposed that allows the generated code to be embedded with high assurance in untrusted object managers using hardware protection rings. The concepts and mechanisms are illustrated with a simple banking example.>

Gutenberg is a port-based operating system being designed to study protection issues in distributed systems. All shared resources are viewed as protected objects and hence can be assessed only via specific operations defined on them. Processes communicate and access objects through the use of ports. Each port is associated with an abstract data type operation and can be created by a process only if the process has the capability to execute the operation on the type. Thus, a port represents the privilege of the port's client process to request a service. Capabilities to create ports for requesting operations are contained in a capability directory, which is navigated by processes to gain these capabilities. Privilege transfer is a means of providing servers access to the resources they need to perform their services. In Gutenberg, privilege transfer is accomplished by allowing access to subdirectories of the capability directory and by passing capabilities, including port access capabilities, to processes via ports. It should be possible to revoke transferred privileges when breaches of trust are detected or suspected, when a period of time has passed beyond which the distributor of a privilege does not want the privilege shared, or when an error has been detected.

An interprocess communication facility provided by the kernel of the Gutenberg experimental operating system is presented. In Gutenberg all interprocess communication is via channels (ports) that are typed by the service which can be requested on them. Ports are created by reference to their service without using the identifier of the process providing the service, a technique the authors refer to as functional addressing. By using functional addressing, interprocess transfer of port use privileges and a new concept of cooperation class, arbitrary process interconnection topologies can be achieved without any explicit use of process identifiers by processes. Examples of object sharing with abstract data type managers and data-driven protocols of database query execution are presented to illustrate the methods of constructing systems of cooperation processes using the Gutenberg system.