Security architecture for distributed systems

Abstract

The paper describes the concept of the security architecture for open distributed systems, which may be used for distributed applications which support a variety of security policies. The components of an open distributed system can be grouped into domains corresponding to organizations, networks or services etc. for the purposes of applying security policy. The paper proposes a design for a security system which is based on use of Kerberos in each domain. Kerberos is extended with several additional security functions: extended access control lists, delegation properties and smart cards. In addition, data confidentiality and data integrity of distributed system resources are provided by configurable cryptographic modules. Finally, the X.509 certificate system is suggested for inter-domain interaction. An example application for the use of this security architecture is briefly described at the end of the paper. © 1994.