1 of 74

DISTRIBUTED COMPUTING

Sunita Mahajan, Principal, Institute of Computer Science, MET League of Colleges, Mumbai

Seema Shah, Principal, Vidyalankar Institute of Technology, Mumbai University

2 of 74

Chapter - 10�Security In Distributed Systems

3 of 74

Topics

Introduction
Overview of security techniques
Secure channels
Access control
Security management
Case study

4 of 74

Introduction

5 of 74

Goals of computer security

Secrecy
Privacy
Authenticity
Integrity

6 of 74

Approaches to computer security

Physically limited access
Hardware mechanisms
Operating system mechanisms
Programming strategies

7 of 74

Complete security

External security
Internal security

User authentication
Access control
Communication security

8 of 74

Potential threats and attacks

Interception
Interruption
Modification
Fabrication

9 of 74

Security mechanisms

Encryption
Authentication
Authorization
Auditing tools
Intruder : person/program vying for unauthorized access to data

10 of 74

Attacks

Passive attacks
Browsing
Inferencing
Masquerading

Active attacks
Virus
Worm
Logic bomb
Integrity attack
Authenticity attack
Delay attack
Replay attack
Denial attack

11 of 74

Categories of Virus-1

(Continued in next slide)

12 of 74

Categories of Virus-2

13 of 74

Virus vs worm

14 of 74

Integrity Attack

15 of 74

Authenticity attack

A

16 of 74

Denial attack

17 of 74

Delay attack

18 of 74

Replay attack

19 of 74

Confinement problems

20 of 74

Types of channels

Legitimate channel
Storage channel
Covert channel

21 of 74

Design issues

Minimum privilege
Fail safe defaults
Build it into the system
Check for current authority
Easy grant and revocation of access rights
Build firewalls
Cost effectiveness
Simplicity

22 of 74

Focus of control

Protection against invalid operations on secure data
Protection against unauthorized invocations
Protection against unauthorized users

23 of 74

Protection

24 of 74

Layering of security systems

Application

25 of 74

RISSC

26 of 74

Cryptography

27 of 74

Basic operations: �Encryption and decryption

28 of 74

Types

Symmetric cryptosystem
Asymmetric cryptosystem
Using Hash function

29 of 74

DES algorithm

30 of 74

DES Key generation

31 of 74

Needham –Schroeder algorithm

Needham –Schroeder Symmetric key protocol
Needham –Schroeder public key protocol

32 of 74

Asymmetric cryptosystem

33 of 74

RSA protocol

Key generation
Encryption of message
Decryption of message
Digital signing
Signature verification

Alice’s

public key

34 of 74

Hash function MD5

35 of 74

MD5

36 of 74

Secure Channels

37 of 74

Authentication

User login authentication
One way authentication of communicating entities
Two way authentication of communicating entities

38 of 74

User log in authentication

Maintain secrecy of passwords
Make passwords difficult to guess
Limit damage due to a compromised password
Identify and discourage unauthorized login
Adopt Single sign-on policy for using system resources

39 of 74

One way authentication of communicating entities

Protocols based on symmetric cryptosystems
Protocols based on asymmetric cryptosystems

40 of 74

Two way authentication of communicating entities

K_S+

41 of 74

Authentication

42 of 74

Message Integrity and Confidentiality

Digital signature

43 of 74

Using message digest

Session key

44 of 74

Secure group communication

Confidential group communication
Secure replicated servers

45 of 74

Access Control

46 of 74

General issues

47 of 74

Protection domains �Domain is an abstract definition of a set of access rights

48 of 74

Realizing domains

Each user has a domain
Each process has a domain
Each procedure has a domain
Domains may be disjoint

49 of 74

Hierarchical grouping

50 of 74

Access matrix

51 of 74

Issues in representing protection state

Deciding the contents of the access matrix
Validating access to objects by subjects
Allowing subjects to switch domains in a controlled manner
Allowing changes in the protection state of the system in a controlled manner

52 of 74

Access matrix- 1

53 of 74

Access matrix-2

54 of 74

Implementation of Access Matrix

Access Control Lists (ACL)

Access validation,
Granting rights
Passing rights
Revoking rights

Capabilities

55 of 74

Firewalls

56 of 74

Secure mobile code

Protecting an agent
Protecting the target

57 of 74

Sandbox

58 of 74

Java object references as capabilities

59 of 74

Stack introspection

60 of 74

Security Management

61 of 74

Key management

Key establishment
Diffe-Hellman key exchange

62 of 74

Key distribution

Key distribution in symmetric cryptosystem

Centralized approach
Fully distributed approach
Partially distributed approach

Key distribution in asymmetric cryptosystem
Lifetime certificates

63 of 74

Issues in key distribution

Baby

64 of 74

Secure group management

Have a group of secure servers
Use KDCs and CAs

Authorization management

Grant access rights to a user group
Use capabilities to get access rights
Capability is a list of ordered pairs, associated with a domain and defines all objects to which a domain has access rights

65 of 74

Capabilities

Access validation
Granting and passing rights
Protecting capabilities against unauthorized access
Rights amplification
Rights revocation
Hybrid approach

66 of 74

Delegation of access rights-1

67 of 74

Delegation of access rights-2

68 of 74

Case Study

69 of 74

Kerberos system-1

70 of 74

Kerberos system-2

71 of 74

Kerberos-3

72 of 74

Kerberos-4

73 of 74

Epayment

Methods
Secure electronic transactions

Open standard for protecting the privacy and ensuring the authenticity of electronic transactions

Major technologies used are

DES for confidentiality of information
RSA for data integrity
Digital signatures with SHA-1 hash code

74 of 74

Summary

Introduction
Overview of security techniques
Secure channels
Access control
Security management
Case study