1. peer-to-peer and agent-based computing
Security in Distributed Systems

2. peer-to-peer and agent-based computing
Plan of lecture
Introduction and Design Issues
Threats to security systems
Security mechanisms
Design issues: focus of data control, layering of security mechanisms and simplicity
Cryptography
Basics of cryptography
Types of encryption: symmetric, asymmetric and Hash functions
Secure Channels
Using symmetric keys
Using public/private keys
Signing/Digital signatures
Secure Mobile Code: sandboxing
peer-to-peer and agent-based computing

3. peer-to-peer and agent-based computing
Security threats
4 possible threats to security in computer systems:
Interception: unauthorised party has gained access to a service or data
E.g. eavesdropping, illegal copying of data (or files)
Interruption: when a service or data becomes unavailable, unusable, destroyed etc.
E.g. when a file is lost or corrupted, denial of service by malicious attacks
Modification: unauthorised change in data or service
Intercepting and changing transmitted data
Changing the behaviour of a service
Altering database entries
Fabrication: generating data or activity that would not normally exist.
E.g., adding a password into a password file or database or falsifying a service
peer-to-peer and agent-based computing

4. peer-to-peer and agent-based computing
Security mechanisms
Need a security policy
Security mechanisms by which a policy can be enforced:
Encryption: transforms data (encrypts) into unintelligible data i.e. implements confidentiality, integrity
Authentication: verify the claimed identity of the user e.g. passwords, public/private-keys
Authorisation: is user authorised to access the resource? e.g. unix
Auditing: track which clients accessed what
peer-to-peer and agent-based computing

5. peer-to-peer and agent-based computing
Design issues
Focus of Control
Layering of Security mechanisms
Simplicity
peer-to-peer and agent-based computing

6. peer-to-peer and agent-based computing
Focus of data control
Methods
Data
Method
Data is protected
against unauthorised
invocations
Methods
Data
User
Data is protected by
checking the role of invoker
Methods
Data
Data is protected against
wrong or invalid operations
There are three levels of protecting data within a distributed system:
At the Data Level: protect the data directly from wrong or invalid operations. This is irrespective of the actual methods or operation that can be performed on a data item. The main concern here is concerned with data integrity. This type of protection typically is implemented in database systems in which various integrity constraints can be formulated that are automatically checked each time data is accessed and modified. An example here could be the array-bounds checking used in Java programs. Each time you attempt to access an array using an integer index, the Java Virtual Machine checks to see if this operation is legal. If it is then access is granted, otherwise an exception is thrown.
At the Method Level: By restricting which operations can be applied to the data and by whom. In this case the focus is closely related to the access control mechanisms for the data. This is directly equivalent therefore to an object where the data is encapsulated within an object and access to that data can be made through the classes access methods. For example, in object-based systems this one could control the access to the data via a specific data access methods contained within the interface to an object or, alternatively, could allow access to the object directly. This approach obviously gives rise to various levels of granularity.
At the User Level: Here, the focus is directly on the users of the system i.e. only selected users can have access to the application regardless of what operations they want to perform. A user role is defined for each user. For example, on Windows XP, there are two ‘user roles’: a Computer Administrator or Limited. A computer administrator can install programs and hardware, make system-wide changes, access and read all non-private files, create and delete user account whereas a Limited user can only change their own picture and create, change or remove their own password and data.
peer-to-peer and agent-based computing

7. Layering of security mechanisms
Application
Middleware
OS Services
Transport
Network
Datalink
Physical
OS Kernel
Hardware
Low-level
protocols
High-level
Machine A
Machine B
Issues:
An important design issue for implementing secure systems is to decide at which level the security mechanisms should be placed. The ‘level’ is related to the logical organization of a system into a number of layers. For example, consider the layers for applications, middleware, operating system services, operating system kernel and communications. Figure 1 illustrates an important separation of general-purpose services from communication.
Further, it is important to relate this to the notion of trust. A system can be secure (within reasonable grounds) but whether a customer trusts it is another matter. Therefore, a considerable factor in the decision of how to layer the security of a system depends on how much a client trusts the security of the services in the particular layer (and those below it).
Trust Example: For example, say Tim on machine A wanted to send a message to Gareth on machine B. If Tim is worried that his confidential message will get interrupted then he must choose a secure service for doing this. Say, he chooses secure RPC to perform this operation then he must trust that secure RPC performs the operation it says it does. However, since secure RPC uses SSL (secure sockets layer – secure communication via sockets) then Tim needs to trust that SSL is also secure. If he does not then he may choose another form of secure communication, such as public-keys. As a designer of a security system all these factors are important in deciding which level to place the security mechanisms.
TCB Example: Dependencies between services regarding trust lead to the notion of a Trusted Computer Base (TCB). TCB is the set of all security mechanisms for a (distributed) computer system that are needed to enforce a security policy. For example, a system implemented at the middleware level relies on the security of the underlying operating systems. If these are adequate then the TCB could include the local operating systems at various hosts. However, if they are not then these security policies may be implemented at the middleware level. Globus for example includes its own set of security polices at the global level but leaves the local administration deal with local security levels.
Reduced Interfaces for Secure System Components (RISCC) approach: Here, any security-critical server is placed on a separate machine isolated from end-user systems using low-level secure network interfaces. Clients and their applications can access the server only through the secure network interfaces. For example, in the Physics Department, the Triana [5] web server was implemented in this way. This web server had the capability of creating user accounts and the purchasing and downloading of software. Each user’s password and information must be kept private. On the actual server therefore, every means of communication is turned off except that it runs an SSH server. Furthermore, only one machine in the department can be used to access this server by using the SSH command. If data is needed to be uploaded to the server then the administrator needs to SSH to the machine and then ftp back to the machine which they want to download the data from.
At which level are the security mechanisms placed? - communication or services (Middleware)
Depends on the trust of the client
peer-to-peer and agent-based computing

8. peer-to-peer and agent-based computing
Simplicity
The good news:
The fewer security mechanisms, the better!
The mechanisms
Need to be easily understood
And trusted to work!
Simplicity contributes to trust that end users put into the application
The bad news:
Often applications are too complex and security only makes matters worse!
peer-to-peer and agent-based computing

9. peer-to-peer and agent-based computing
Cryptography
Basics of cryptography
Types of encryption
Symmetric encryption
Asymmetric encryption
Hash functions
peer-to-peer and agent-based computing

10. Basics of cryptography
Sender
Receiver
Plaintext
Passive
Intruder,
only listens
Active
Can insert
message
Can change
Defence from:
Plaintext, P
Key K
Ciphertext, C
Encryption
Method Ek(P)
Network
Decryption
Method Dk(C)
peer-to-peer and agent-based computing

11. peer-to-peer and agent-based computing
Types of encryption
Text converted to ciphertext via algorithm & key
Algorithm is publicly known
Key is held private
Three main categories
Secret Key (symmetric cryptosystem)
single key is used to encrypt and decrypt information
Public/Private Key (asymmetric cryptosystem)
two keys are used: one for encryption (public key) and one for decryption (private key)
One-way Function (hash functions)
information is encrypted to produce a “digest” of the original information that can be used later to prove its authenticity
A cryptosystem is a system in which encryption and decryption are performed in association with the transmitting and receiving functions. A hash function is a one-way function. There are three main categories for encryption:
peer-to-peer and agent-based computing

12. peer-to-peer and agent-based computing
Symmetric encryption
Sender and receiver have same secret key that will encrypt and decrypt plain text
Strength of encryption technique depends on key length
Symmetrical algorithms:
Data Encryption Standard (DES) – 56-bit key
Triple DES, DESX, GDES, RDES – 168-bit key
RC2, RC4, RC5 – variable length, up to 2048 bits
IDEA – (basis of PGP) 128-bit key
Blowfish – variable length, up to 448 bits
Here, the same key is used for encryption and decryption. Keys can be create in a number of ways e.g. they can be generated once and used over and over again or they can be generated for each session.
peer-to-peer and agent-based computing

13. Example: Data Encryption Standard (DES)
Widely-used
Private (secret) key, so difficult to break it was restricted for export by US Gov.
72,000,000,000,000,000 (72 quadrillion) or more possible encryption keys
Key chosen at random
Both sender and receiver must know and use the same private key
Can run in several modes and involves 16 rounds or operations
Many companies use “triple DES”, applying three keys in succession
In 1997, Rivest-Shamir-Adleman, owners of another encryption approach, offered a $10,000 reward for breaking a DES message
Cooperative effort on the Internet of over 14,000 computer users trying out various keys finally deciphered the message, discovering the key after running through only 18 quadrillion of the 72 quadrillion possible keys!
peer-to-peer and agent-based computing

14. Asymmetric encryption
Better known as Public/Private Key
User X has pair of keys, one public & one private
To encrypt a message to X, Y uses X’s public key
X will decrypt encrypted message using X’s private key that “matches” X’s public key
Uses modular arithmetic & elementary number theory
Based on the fact that it is extremely difficult to find the prime factors of large numbers
Used in
Pretty Good Privacy (PGP)
The Secure Sockets Layer (SSL)
S/MIME, Secure Electronic Transactions (SET)
Secure Shell (SSH)
Included in Web browsers (Microsoft Internet Explorer)
One popular example, of a public-key system is RSA named after the inventors (Rivest, Shamir and Adleman 1978). The security of RSA is based on the difficulty of factoring large numbers that are the product of two prime numbers. This factoring problem has been studied for hundreds of years and still appears to be intractable. For this reason, people are confident of RSA’s security, and it has become fundamental to information security. Another "warm and fuzzy" reason for RSA’s popularity should not be overlooked. Contrary to some other cryptographic systems such as Elliptic Curve cryptography, it is relatively easy for executives, managers, and other decision-makers who do not have a technical or mathematical background to understand the difficulty of factoring a very large number, and thus feel confident in the security provided by the RSA algorithm. As a result, RSA is widely used today in many of the encryption applications and protocols in use on the Internet, including:
peer-to-peer and agent-based computing

15. peer-to-peer and agent-based computing
Hash functions
One-Way functions
Non-reversible “quick” encryption
Produces a fixed length value called a hash or message digest
Used to authenticate contents of a message
Common message digest functions
MD4 and MD5: produce 128 bit hashes
SHA: produces 160 bit hashes
peer-to-peer and agent-based computing

16. peer-to-peer and agent-based computing
Secure channels
Protecting communication between two users
E.g. peer-to-peer or client/server
Two types:
Symmetric
Shared Secret Keys
Session Keys
Asymmetric, i.e. Public/Private Key
peer-to-peer and agent-based computing

17. Uses of secure channels
Secure Socket Layer (SSL):
Improves safety of Internet communications
Standard for encrypted client/server communic.
Protocol that runs on top of TCP/IP
Uses several security techniques e.g. public keys, symmetric keys, and certificates.
Web sites commonly use SSL to guard private information such as credit card numbers
Transport Layer Security (TLS):
Protocol which ensures privacy between users
Successor to SSL
peer-to-peer and agent-based computing

18. Symmetric: shared secret keys
Generated once and secretly passed to the individuals
This can be done in a number of ways:
Other methods e.g. by using public-keys
Telephone each other
Post it to each other
Example system that uses this
Kerberos (
peer-to-peer and agent-based computing

19. Symmetric: session keys
Dynamically created at run time
Can be done in two ways:
Using public-keys
Cumbersome
Poor performance
Dynamically create using Diffie-Hellman key exchange (next slide)
peer-to-peer and agent-based computing

20. Symmetric Diffie-Hellman key exchange
Also called “exponential key agreement”
Developed in 1976,
Published as ground-breaking paper “New Directions in Cryptography”
Allows 2 users to exchange a secret key over an insecure medium without any prior secrets:
Both pick 2 large numbers, n and g (public), subject to certain mathematical properties
Tim chooses secret large random number, x
Gareth chooses secret large random number, y
Tim computes (g x) mod n (public: virtually impossible to compute x from g x mod n)
Gareth computes (g y) mod n
They exchange public keys (g x) mod n and (g y) mod n
Gareth computes ((g x) mod n)y mod n = g xy mod n
Then, Tim computes ((g y) mod n)x mod n = g xy mod n
Both now have the shared secret key g xy mod n
peer-to-peer and agent-based computing

21. Asymmetric public/private key pairs
Scenario:
Tim sold Gareth a data projector for £750 in a chat room
was their only communication channel
Gareth sends Tim a message confirming that he will buy the projector for £750
Two issues:
Tim needs to be assured that Gareth cannot deny ever having sent the message (if he has second thoughts)
Gareth needs to be assured that Tim will not change the sum of £750 specified in his message to something higher…
peer-to-peer and agent-based computing

22. Asymmetric public/private key pairs
Using RSA keys:
Gareth encrypts the message using his private key
Gareth also encrypts the message (for privacy) using Tim’s public key
Tim can first decrypt the message using his private key then he can use Gareth’s public key to decrypt the original message from Gareth
What can be inferred:
If Tim accepts that Gareth’s public key is in fact his then this must mean that the message came from Gareth
Gareth knows that Tim received the message containing the original message because only Tim can open the message as he is the only person who has access to his private key
peer-to-peer and agent-based computing

23. peer-to-peer and agent-based computing
Digital signatures
Asymmetric cryptosystems allow users to digitally sign messages
Allows a user to establish their authenticity
A hash function is used to create & verify a digital signature
Converts the document into a hash
Concise and efficient for calculation
peer-to-peer and agent-based computing

24. peer-to-peer and agent-based computing
Signing
Hash
Function
Message To
Verifier
Signing
Function
Digital
Signature
The signer first delimits precisely what is to be signed within the message element i.e. a document or a key etc. A hash function is then applied to this
message, which results in a hash code (e.g bit SHA-1) unique to the message content. This hash result is then transformed into a digital
signature using the signer's private key (i.e. it is encrypted). The resulting digital signature is therefore unique to both the message and the
private key of the user that created it. The digital signature is typically attached to its message, either by storing it within a specific format
e.g. X.509 certificate, or transmitted along with the message.
Private
Key
peer-to-peer and agent-based computing

25. peer-to-peer and agent-based computing
Verifying
Hash
Function
Message
Valid
Yes/No?
From
Signer
Verify
Function
Digital
Signature
When a user wishes to verify a digital signature (see Fig), s/he computes a new hash from the original message using the same hash function as the
one used to create the digital signature. The user now can first check whether the key was signed using the signer's private key by using the signer's public key to decrypt the message. Then, if this succeeds then the user can check whether this newly computed hash result matches the hash result extracted from the digital signature. If they match then the verification is complete.
Public
Key
peer-to-peer and agent-based computing

26. Digital signature verification
Verification indicates that:
The digital signature was created by the signer (i.e., the only person with access to private key)
The message was not altered since it was signed (“collisions” are mathematically improbable)
There are different mathematical formulae and procedures, but all share overall operational pattern
NB: signing does not encrypt a message!!
It is merely a method of verifying identity
However, encrypting a message with a private key also verifies a message
Much less efficient if this is its only purpose, though…
peer-to-peer and agent-based computing

27. peer-to-peer and agent-based computing
Secure mobile code
How do you trust remote code to run locally?
Traditionally, you prevented malicious code from running on your system
Use the “sandbox” security model
Downloadable program executed in a way that each of its instructions can be fully controlled
peer-to-peer and agent-based computing

28. peer-to-peer and agent-based computing
Sandboxing with Java
A Java sandbox prohibits:
Reading or writing to the local disk
Making network connections to any host, except the host that hosted the applet
Creating a new process
Loading a new dynamic library and therefore directly calling a native method
Typically for applets
Also for P2P?
“Signed applets” trusted
Treated like local code
peer-to-peer and agent-based computing

29. Further reading and resources
Chaper 8 of textbook
Article “New Directions in Cryptography”, Whitfield Diffie and Martin E. Hellman.
Kerberos Web page
peer-to-peer and agent-based computing