Authority delegation with secure operating system queues

Details Authority delegation with secure operating system queues Authority delegation with secure operating system queues

1998-07-21

2001-02-13

Beausoleil, Robert (Department: 2184)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

Reexamination Certificate

active

06189103

ABSTRACT:

FIELD OF THE INVENTION
The present invention relates to delegation of user authority in a distributed computing environment, and relates more particularly to the delegation of authority to servlets and other distributed computing tasks using secure operating system queues.
TECHNICAL BACKGROUND OF THE INVENTION
Web servers are computers configured to respond to requests from other computers for web pages. A web server may be part of a global computer network, part of an intranet, or part of another network. Various communication protocols may be used, both at lower network levels (TCP/IP, SPX, and so on) and at higher levels (hypertext transfer protocol, file transfer protocol, and so on) in combination with various web page formats (HTML, XML, and so on). Many web sites are primarily linked pages of hypertext and images, but web pages increasingly contain database inquiries, email addresses, and other information that calls for more than the mere presentation of previously specified text and graphics. Accordingly, various attempts are being made to extend the functionality of web servers.
One approach extends web servers to make them capable of running “servlets.” Servlets are focused code components (sometimes called “modules” or “plug-ins”) which can be added to an existing server with relatively little effort. Each servlet preferably has a well-defined task, such as servicing database requests, sending email, translating IP addresses into domain names, uploading files, posting news group messages, and so forth. Java servlets are portable between platforms by virtue of being implemented in Java bytecodes (JAVA is a mark of Sun Microsystems, Inc.). Indeed, “servlet” is often (but not always) used as a synonym for “Java servlet.”
Regardless of the terminology used, many of the security considerations that apply to Java servlets apply to other executable tasks as well. Security is a particular concern when an executable task may be loaded by a server and then run as a separate thread or process to extend the server's functionality by performing a specific job. In addition to Java servlets, such executable tasks include NetWare Loadable Modules and other modules or components implemented in native code, as well as native or Java applications initiated by (or closely coordinated with) the server.
Server security is a concern for several reasons. A server typically has broader access rights than the clients it serves, and the server often runs on behalf of different users at different times. Precautions must be taken to protect the confidential information of the various users. In many systems, servlets run by the server also have broad rights because a thread or other process created by a server process normally has the same rights as the server process. Thus, servlets and similar tasks must either be trusted to the same extent as the server that runs them, or else precautions must be taken to prevent security breaches by such tasks.
The fact that servlets may be loaded dynamically from a source outside the server makes security breaches an even greater concern. The origins and history and behavior of the remote servlet are not necessarily known to the local server administrator. Even if certain origins or behavior are stated for the remote task, such statements might be untrue. Unless suitable precautions are taken, for instance, a malevolent servlet could present itself as a legitimate database update server and then make illicit changes to the database. Or the server might do the job it was called on to do, such as sending and delivering email messages, but do illicit work as well, such as gathering user passwords and periodically mailing them to an unauthorized location.
One general approach taken to improve servlet security imposes a “sandbox” model. All servlets loaded from the server's disk are trusted, and thus have the same security rights as the server itself. By contrast, all servlets loaded from a remote location are untrusted. Untrusted servlets are invoked by a separate instance of the server's dispatcher and they run in a group of untrusted threads which are kept apart from the trusted threads. This means, among other things, that untrusted servlets cannot access the program data and instructions of trusted servlets, so an untrusted servlet cannot gain unauthorized access to system resources by infecting or taking over a trusted servlet. This approach is called a “sandbox model” because one set of servlets gets to play in the sandbox (the server's space) with broad rights or even all possible rights, while other servlets are excluded from the sandbox in the sense that they have very limited security rights.
In addition to the sandbox model, Access Control Lists are used in some systems. An Access Control List (“ACL”) is a data structure associated with a system resource and used to control access to the resource. ACLs assume that an authentication method is available to identify users, and they also assume the use of user or group permissions information that reflects the possible ACL settings.
When a user logs onto a system that uses ACLs, the system first uses a login name to identify the user and then uses an authentication means such as a password, biometric scan, ID card, or other means to determine whether the stated identity is correct. When an authenticated user tries to access a resource such as a file, database, email account, printer, or other resource, the system compares the rights of the authenticated user with the rights required to perform the requested access and then allows or denies access accordingly.
In one system using a sandbox model, the server and the trusted servlets which run as threads of the server are either not subject to authentication or else are authenticated to a powerful user such as “root” or “admin.” The untrusted servlets run as threads of a separate dispatch process, which is authenticated by the server as a user having relatively high priority for execution but very restricted security rights. In one system, there is a server-wide ACL and separate ACLs can be specified to control access to a specific file, directory, or servlet. Using ACLs to control access to servlets is one way to reduce or prevent unauthorized changes to trusted servlets.
Another general approach taken to improve servlet security requires the servlet to present the server with authenticating credentials before the server will let the servlet run. Credentials may be based on shared symmetric keys, on a public key infrastructure, on digital signatures, on certificates issued by one or more Certification Authorities, or on certificates issued according to a so-called web of trust; in many cases, credentials are based on some combination of these items.
One of the many possible examples of servlet security based on credentials is the sun.security.TrustDecider method is TrustedFor( ), which checks to see whether an entity named in a certificate chain is trusted for a specified purpose. The certificate chain normally includes the servlet certificate, the certificate for the servlet's Certification Authority, the certificate for that Authority's Certification Authority, and so on up to a root Certification Authority's self-signed certificate. Specified purposes may include authenticating a peer through a secured channel or authenticating a specific code signer, for instance.
Unfortunately, both the sandbox model and the use of credentials have serious drawbacks when applied to servlet security. The sandbox model is not very flexible. Although servlets loaded from remote locations must generally be treated with caution, some remote locations, and some servlets, are more trustworthy than others. But a strict sandbox approach makes all remotely loaded servlets equally untrusted. Likewise, the sandbox model violates the principle of least privilege (“each process gets only those privileges its needs to do its legitimate work”) by giving every locally loaded servlet full server rights. Even if the locally loaded servers are not mal

Affiliated with

Also associated with

Rating

Authority delegation with secure operating system queues does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Authority delegation with secure operating system queues, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Authority delegation with secure operating system queues will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2567689