1. Introduction and Motivation2. JINI3. A Software Architecture for Role-Base Security3.1 A Proposed Software Architecture3.2 Security Resources and Services3.2.1 Role-Based Privileges Resource3.2.2 Authorization-List Resource3.2.3 Security Registration Resource3.3 Security Client and Resource Interactions3.4 Client Interactions and Processing4. Experimental Prototype4.1 Baseline Prototype for GUI Security Interactions4.2 The Security Client Prototype5. Conclusions and Future WorkReferencesRole-Based Security in a Distributed Resource Environment Role-Based Security in a Distributed Resource EnvironmentProfs. S. A. Demurjian and T.C. TingJ. Balthazar, H. Ren, and C. PhillipsComputer Science & Engineering Dept.The University of ConnecticutStorrs, CT [email protected]: 860.486.4818Fax: 860.486.4817 Dr. P. BarrThe MITRE Corp145 Wyckoff RoadEatontown, New Jersey [email protected]: 732-935-5584Fax: 732-544-8317AbstractThere are many technologies for distributed processing/interoperation, including CORBA,DCE, DCOM, Enterprise Java Beans, Java IDL, JDBC, etc. Most promising, is theemergence of the distributed resource environment, which allows all of the components thatcomprise a distributed application (i.e., software components like servers, legacy systems,databases, COTs, etc., and hardware components like printers, scanners, etc.) to be treatedakin to operating system resources, where each component (resource) can publish services(an API). Once published, these services are available for use by clients and resources alike.However, distributed resource environments have lagged in support of security, providingminimal functionality to control the availability of a resource’s services to clients. Toaddress this deficiency, this paper concentrates on proposing a technique for seamlesslyintegrating a role-based security model, authorization, authentication, and enforcement intoa distributed resource environment. In addition, we consider the specific challenges andproblems in supporting role-based security and authorization in an actual distributedresource environment, namely Sun’s Java-based JINI. JINI promotes the construction anddeployment of robust and scalable distributed applications via leasing of services byresources and two-phase commit transactions.1. Introduction and MotivationDistributed computing applications for the 21st century, constructed from legacy, commercial-off-the-shelf (COTS), database, and new client/server applications, will require stakeholders (i.e.,software architects, system designers, security officers, etc.) to architect and prototype solutionsthat facilitate the interoperation of new and existing applications in innovative ways. Toadequately support this, the network and its software infrastructure must be an active participantin the functional processing of distributed applications, and security must play a fundamental role.The emergence of distributed computing technology such as DCE [OSF94, Rose92], CORBA[OMG95, Vino97, Yang96], and DCOM [Micr95], has enabled the parallel and distributedprocessing of large, computation-intensive applications. The incorporation of security has oftenbeen dependent on programmatic effort rather than a cohesive mechanism seamlessly incorporatedinto the underlying technology. For example, even though CORBA contains individual securityservices for confidentiality, integrity, accountability, and availability, there is no cohesive CORBAThis work supported in part by the Mitre Corporation (Eatontown, NJ) and a research grant from AFOSR andpresented at IFIP WG 11.3 14th Working Conference on Database Security.1Role-Based Security in a Distributed Resource Environmentservice that ties these and other concepts (authorization, authentication, and privacy) togetherinto a cohesive security solution. However, there has been significant progress in distributedauthentication in Kerberos [Neum94] and Cheron [Fox96], security metric analysis and design[Reit99], Internet security via firewalls [Oppl97], role-based access control on Web-basedintranets [Sand98], and security for mobile agents [Swar97, Wall98]. Our specific interest is in distributed applications that plug-and-play, allowing us to plug in (andsubtract) new “components” as needs, requirements, and even network topologies change overtime. Historically, the plug-and-play of components on a network has concentrated on hardwareresources (e.g., printers, RAID arrays, scanners, etc.) that have defined operating system services,published via an application programmers interface (API). We extend the concept of plug-and-play resources to include software in addition to hardware, where all of the resources (e.g.,legacy, COTS, databases, servers, etc.) have services that are published (via APIs) for use bydistributed application components. The resources, their services, and the clients, interactingacross the network, comprise the distributed resource environment for the distributed application.Our goal in this paper is to leverage the infrastructure of a distributed resource environment, tosupport and realize role-based security. In such a setting, we propose a software architecture withspecialized security resources that interact with non-security resources and clients, to authorize,authenticate, and enforce security for a distributed application in a dynamic fashion. Todemonstrate the feasibility of our approach, we exploit Sun’s distributed resource environmentJINI [Arno99, JINI, JINIARCH].JINI promotes the construction and deployment of robust and scalable distributed applications,providing the infrastructure for a distributed resource environment. In JINI, a distributedapplication is conceptualized as a set of services (of all resources) being made available fordiscovery and use by clients, which forces software engineers to adopt a client/services view. Toaccomplish this, JINI makes use of one or more Lookup Services. Resources in JINI discover andthen join the Lookup Service, registering their services for network availability. A distributedresource environment, in general, and JINI, in particular, has goals that include: network plug-and-play of clients and services; enabling
View Full Document
Unlocking...