Horton’s Who Done It?

Communicating Authority with

Responsibility Tracking

Mark S. Miller Google Research1

Jed Donnelley LBNL/NERSC

Alan H. Karp HP Labs

Usenix HotSec Workshop, August 7, 2007

1Work done while at HP Labs

Doc Chapters:

Chapter 1…

Communicating Object Access with Delegation

Initial Conditions:

Alice has: 1. A capability to send to Bob and 2. A capability to a document with chapters.

Alice Bob

Doc Chapters:

Chapter 1…

Capability Communication of the Document Reference

here’s( )

Chapter 1…

Alice sends a message to Bob containinga reference to the document.

Alice Bob

Doc Chapters:

Chapter 1…

Alice-

Alice can’t act with Bob’s responsibilityBob can’t act with Alice’s responsibility

Horton Magic: Bob Receives a Delegated Capability

Delegating Least Authority

b.foo(c)

foo( )

• Msgs are only means to cause effects

• Refs control authority

• Leverage OO patterns

• Msgs are only means to cause effects

• Refs control authority

• Leverage OO patterns

• Anonymous

Two styles, relative strengths

Program decisions

Fine-grained

Built for safety

Least authority

Virus resistant

Authorization-based

Object-capabilities (ocaps)

Human decisions

Large-grained

Built for damage control

Most responsibility

Spam resistant

Identity-based

Program decisions

Fine-grained

Built for safety

Least authority

Virus resistant

Authorization-based

Human decisions

Large-grained

Most responsibility

Spam resistant

Identity-based

Polaris, PlashBitfrost?

Program decisions

Fine-grained

Built for safety

Least authority

Virus resistant

Authorization-based

Human decisions

Large-grained

Most responsibility

Spam resistant

Identity-based

ACLs+ “Hybrid” Cap Systems (SCAP, Sys/38)

Program decisions

Fine-grained

Built for safety

Least authority

Virus resistant

Authorization-based

Human decisions

Large-grained

Most responsibility

Spam resistant

Identity-based

Program decisions

Fine-grained

Built for safety

Least authority

Virus resistant

Authorization-based

Human decisions

Large-grained

Most responsibility

Spam resistant

Identity-based

Horton

Can’t vet code or actions of each object.

Aggregate into long-lived responsible identity.

Story Needs Four Characters

Alice & Bob• Old patterns for identity-based control: identity tunnel

Alice introduces Bob & Carol• Builds new relationships from old

Carol also hears of Bob from Dave• Corroborates Bob’s independence from Alice

Two-party intermediation

A message travels through anidentity tunnel

Alice Bob

Aliceb.foo()

A Bfoo()

Alice Bob

Do I still use Bob’s services?

Alice Bob

Bob, deliver to Bfoo()

Alice Bob

deliver(“foo”,[])

Alice Bob

Do I still honorAlice’s requests?

Alice Bob

Deliver toB for Alice

Alice Bob

Three-party intermediation

Build new relationships from old

Alice Bob

b.foo(c)

Alice Bob

foo( )

Alice Bob

intro( )

Carol, please provide Bob access to C

foo( )

Alice Bob

intro( )

Alice needs tunnel for Bob

foo( )

Alice Bob

intro( )

BobGift wrap it

for Bob

foo( )

Alice Bob

intro( )

BobGift wrap it

for Bob

To BobFrom Carol

foo( )

Alice Bob

intro( )

Bobreturn Bob’s

To BobFrom Carol

foo( )

Alice Bob

To BobFrom Carol

Bob, deliver “fo__ to B with

Carol’s ( )foo( )

Alice Bob

To BobFrom Carol

deliver(“foo”,[[ , ]])

Alice Bob

To BobFrom Carol

deliver(“foo”,[[ , ]])

Unwrap Carol’sgift from Alice

Alice Bob

foo( )

Unwrap Carol’sgift from Alice

Alice Bob

foo( )

Alice Bob

Is Bob a pseudonymfor Alice?

Four party intermediation

Only corroborating introductions let Alice shed blame

Alice Bob

Carol Dave

Better Identities than ACLs

Fully decentralized• No global administrator or name server

Track bilateral responsibility• For requests and for service• Also tracks delegation chain

Sybil resistant aggregation strategy

Corroboration-driven disaggregation

Conclusions

Delegate authority, bound to responsibility for using that authority.

Fine-grain least authority for safety.Large-grain identities for damage control.

Reference implementations in Java & E: http://erights.org/download/horton/

Three-party intermediation

The details

Rights Amplification

• Inspired by PK

• Simple oo pattern

• No explicit crypto

• Can represent responsible identity

b.foo(c)

Bob, please use Carol’s C

Make a stub for Bob’s use

Gift wrap it for Bob

wrap(s3, whoBob, beCarol)

seal( )

wrap(s3, whoBob, beCarol)

return gift

unwrap( , whoCarol, beBob)

unseal( )

unwrap( , whoCarol, beBob)

makeProxy(..)

E.call(..)

Alice Bob

Carol Dave

CapWiki with attribution

The Web: Good, Bad, and Ugly:

1. Good: Internet hypertext, wonderful!

2. Bad: Username/passwords for every site that has any sort of access control.

3. Ugly: Hard to share limited access to network objects. Hard to combine network objects with access restrictions.

Sends:BobSendEveSendIvanSend

Alice’s Domain

CapWikiFinances:InvestorMarket

Ali ce’s

Alice’s Domain

CapWiki:CapWiki Stuff:ConceptsFinancesOther

Sends:AliceSendDaveSend

Alice’s Domain Bob’s Domain

Ali ce’s

Receives:AliceReceive

CapWiki:CapWiki Stuff:ConceptsFinancesOther Sends:

AliceSendDaveSend

Ali ce’s

Receives:*AliceReceive

Ali ce’ s

Alice BobSends:BobSendEveSendIvanSend

Ali ce’ s

Alice Bob

Ali ce’ s

Here are theCapWiki:FinancesDave

Receives:BobReceiveDaves’s Domain

Bo b’s

Alice Bob

Ali ce’ s

Receives:* BobReceiveDaves’s Domain

Bo b’s

Alice Bob

Ali ce’ s

Receives:BobReceive

Bo b’s

Daves’s Domain

Alice Bob

Receives:*AliceReceive

Ali ce’ s

Receives:BobReceive

Bo b’s

Alice Bob Dave

Daves’s Domain

Alice Bob

Better Web Access Control

• No more passwords – Send a <me>Send to a <service>Send. They know who you are, you know who they are.

• Side benefit – SPAM resistance. Don’t like a source of SPAM, cut it off to any delegation level.

• Principle Of Least Authority (POLA) sharing that can facilitate cross site services.

Alice Bob

Is Carol a pseudonymfor Alice?

Alice Bob

Carol Dave

Alice Bob

Carol Dave

bar( )

Alice Bob

Carol Dave

Alice Bob

Carol Dave

Horton’s Who Done It?

Documents

Software management...for people who just want to get stuff done

AGENDA Who Done It Workshop Continental Breakfast Welcome and Introductions Who Done It Lab Overview of SCBC Resources on MATSC Reserving Your Kit on LARS

Unsung Heroes Who Have Done More to Serve the Oppressed ... · Unsung Heroes Who Have Done More to Serve the Oppressed than Dr. Martin Luther King, the NAACP, etc. ... responses that

Tim Horton’s

Spring 2020 –Horton’s Slides · Spring 2020 –Horton’s Slides Warm Up How many arithmetic operations are required to multiply ... 1 5 8 9 10 17 17 20 24 30 ... •“Top Down”:

Space Night… A Journey Beyond Space Night… A Journey Beyond Created &Presented By Mrs. Horton’s 3 rd Grade Students

Who Gets It Done and How

Who and what do you need to know to get things done

Horton’s Who Done It? · 2016. 12. 30. · Horton’s Who Done It? Communicating Authority with Responsibility Tracking Mark S. Miller Google Research1 Jed Donnelley LBNL/NERSC

K-3 Tim Horton’s Trip Visitor Sign-In SCHOOL NEWS June 2… · K-3 Tim Horton’s Trip On Friday May 24, the K-1 class participated in a field trip to Tim Hortons. Over the past

Top stories CREATIVITY AND MINDFULNESS TO THE ......Harry Potter broomsticks and X-Men inspired treats. Well done to all the boys who took part! Well done to all the boys who took

Who is Karl Popper? And what has he done to us?

A Who’s Guide To Saving Our Planet For Whos Shapes · Hilarious Horton’s Hardy Har Hars! Here are some jokes for elephant and Who lovers everywhere. Why does the Mayor of Whoville

LIST OF ASSISTANT TEACHER WHO HAVE NOT DONE B.Ed AS …edudel.nic.in/upload_2013_14/41_dt_28052013.pdf · LIST OF ASSISTANT TEACHER WHO HAVE NOT DONE B.Ed AS PER MIS DATA (East District)

Robert E. Horton’s perceptual model of infiltration processes

Coat of Many Colors...destroy Horton’s precious Who friends and rallies other jungle animals around her. Because the characters aren’t human, the book offers a more subtle way

Who done it

Oak Valley Middle School Head Coach Paul Carff. Who has done this before?

He who has done evil, expects evil

Estonia, Latvia, Lithuania - who has done the best?! Kaspar Oja