We propose embedding executable code fragments in cryptographically protected capabilities to enable flexible discretionary access control in cloud-like computing infrastructures. We are developing this as part of a sports analytics application that runs on a federation of public and enterprise clouds. The capability mechanism is implemented completely in user space. Using a novel combination of X.509 certificates and Javscript code, the capabilities support restricted delegation, confinement, revocation, and rights amplification for secure abstraction.
The capability mechanism proposed by @cite_9 uses keyed cryptographic hashes in a way similar to Amoeba and supports delegation by chaining hashes. Each entry on the chain can contain regular expressions to express which rights are being delegated. The mechanism is less expensive than our approach, but does not support rights amplification and cannot be used for secure abstraction. The MyProxy service @cite_12 uses X.509 proxy certificates to delegate credentials, but lacks facilities for including and evaluating complex rights functions.
@cite_9 @cite_12
2164365844 2156025508
SUMMARY The MyProxy online credential repository has been used by the grid computing community for over four years for managing security credentials in the grid public key infrastructure. MyProxy improves usability by giving users access to their credentials over the network using password authentication, allowing users to delegate their credentials via web browser interfaces to the grid, and supporting credential renewal for long-running jobs. MyProxy helps administrators secure users private keys by providing an online service from which users retrieve short-lived credentials without distributing long-lived keys to potentially vulnerable end-systems. This paper describes the MyProxy system and its use. Trust management credentials directly authorize actions, rather than divide the authorization task into authentication and access control. Unlike traditional credentials, which bind keys to principals, trust management credentials bind keys to the authorization to perform certain tasks. The Distributed Credential FileSystem (DisCFS) uses trust management credentials to identify: (1) files being stored; (2) users; and (3) conditions under which their file access is allowed. Users share files by delegating access rights, issuing credentials in the style of traditional capabilities. Credentials permit, for example, access by remote users not known in advance to the file server, which simply enforces sharing policies rather than entangling itself in their management. Throughput and latency benchmarks of our prototype DisCFS implementation indicate performance roughly comparable to NFS version 2, while preserving the advantages of credentials for distributed control.