Notes for November 11, 1998

  1. Greetings and Felicitations!
  2. Puzzle of the Day
  3. Ultimate in aging: One-Time Passwords
    1. Example: S/Key
  4. Challenge-response systems
    1. Computer issues challenge, user presents response to verify secret information known/item possessed
    2. Example operations: f(x) = x+1, random, string (for users without computers), time of day, computer sends E(x), you answer E(D(E(x))+1)
    3. Note: password never sent on wire or network
    4. Attack: monkey-in-the-middle
    5. Defense: mutual authentication (will discuss more sophisticated network-based protocols later)
  5. Biometrics
    1. Depend on physical characteristics
    2. Examples: pattern of typing (remarkably effective), retinal scans, etc.
  6. Location
    1. Bind user to some location detection device (human, GPS)
    2. Authenticate by location of the device
  7. Notion of "privilege"
    1. Identity
    2. Functionality
    3. Granularity
  8. Privilege in OSes
    1. None (original IBM OS; protect with password, or anyone can read it)
    2. Fence, base and bounds registers; relocation
    3. Tagged architectures
    4. Memory management based schemes: segmentation, paging, and paged segmentation
  9. User identification
    1. Go through UNIX idea of "real", "effective", "saved", "audit"
    2. Go through notion of "role" accounts; cite Secure Xenix, DG, etc.
    3. Go through PPNs (TOPS-10) and groups
    4. Review least privilege
  10. Privilege in Languages
    1. Nesting program units
    2. Temporary upgrading of privileges
  11. Different forms of access control
    1. UNIX method
    2. ACLs: describe, revocation issue
    3. MULTICS rings: (b1, b2) access bracket - can access freely; (b2, b3) call bracket - can call segment through gate; so (4, 6, 9) as example
    4. Capabilities: file descriptors in UNIX

You can also see this document in its native format, in Postscript, in PDF, or in ASCII text.
Send email to

Department of Computer Science
University of California at Davis
Davis, CA 95616-8562

Page last modified on 11/12/98