On Inter-Realm Authentication in Large Distributed Systems

Article type: Research Article

Authors: Gligor, Virgil D.^a | Luan, Shyh-Wei^b | Pato, Joseph N.^c

Affiliations: [a] Electrical Engineering Department, University of Maryland, College Park, Maryland 20742, USA | [b] VDG Inc, 6009 Brookside Drive, Chevy Chase, Maryland 20815, USA | [c] Cooperative Computing Division, Hewlett-Packard Co., Chelmsford, Mass. 01824, USA

Abstract: We define and rationalize a policy for propagation of authentication trust across realm boundaries. This policy helps limit global security exposures that ensue whenever an authentication service is compromised. It is based on a hierarchical model of inter-realm authentication, and can be supported by both public-key and secret-key systems. As an example, we present a simple protocol which selects inter-realm authentication paths that satisfy the policy. The protocol is part of a design that provides application transparency for authentication-path selection and acceptance as the default mode of operation. The design can be integrated with the security services of existing systems; e.g., of the Open Software Foundation's Distributed Computing Environment (DCE). DCE implementation issues are also discussed.

DOI: 10.3233/JCS-1993-22-305

Journal: Journal of Computer Security, vol. 2, no. 2-3, pp. 137-157, 1993