Client Security in Scalable and Survivable Object Systems

摘要

This report describes an architecture for defending against client capture in a survivable distributed object store called Fleet. The work was primarily concerned with the case in which clients accessing objects are user- driven devices that should be rendered unusable if taken from their rightful owners, but yet are otherwise authorized to invoke methods on objects. Toward this end, we integrate a technique called 'capture resilience' into the Fleet system. We demonstrate that capture resilience has a symbiotic relationship with Fleet: in addition to hardening Fleet against client compromise due to physical capture, the capabilities that Fleet offers permit the construction of a capture protection infrastructure with better properties than were previously attainable. This infrastructure is the primary focus of this document.