Chapter 14 Identity.ppt

November 1, 2004 Introduction to Computer Security Chapter 14: Identity What is identity Multiple names for one thing Different contexts, environments Pseudonymity and anonymity Overview Files and objects Users, groups, and roles Certificates and names Hosts and domains State and cookies Anonymity Identity Principal: a unique entity Identity: specifies a principal Authentication: binding of a principal to a representation of identity internal to the system All access, resource allocation decisions assume binding is correct Files and Objects Identity depends on system containing object Different names for one object Human use, eg. file name Process use, eg. file descriptor or handle Kernel use, eg. file allocation table entry, inode More Names Different names for one context Human: aliases, relative vs. absolute path names Kernel: deleting a file identified by name can mean two things: Delete the object that the name identifies Delete the name given, and do not delete actual object until all names have been deleted Semantics of names may differ Example: Names and Descriptors Interpretation of UNIX file name Kernel maps name into an inode using iterative procedure Same name can refer to different objects at different times without being deallocated Causes race conditions Interpretation of UNIX file descriptor Refers to a specific inode Refers to same inode from creation to deallocation Example: Different Systems Object name must encode location or pointer to location rsh, ssh style: host:object URLs: protocol://host/object Need not name actual object rsh, ssh style may name pointer (link) to actual object URL may forward to another host Users Exact representation tied to system Example: UNIX systems Login name: used to log in to system Logging usually uses this name User identification number (UID): unique integer assigned to user Kernel uses UID to identify users One UID per login name, but multiple login names may have a common UID Multiple Identities UNIX systems a