15.01.2013 Views

U. Glaeser

U. Glaeser

U. Glaeser

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

process at any arbitrary stage in its operations is difficult. The Locus Operating System provided such a<br />

facility, but handling all complex cases is tricky. A more common approach is to provide facilities that allow<br />

processes to enter migratable states where the more complex situations cannot arise. Typically, this means<br />

they are temporarily quiescent until the migration completes. Not providing process migration at all is even<br />

more common. Process migration has not been a popular capability in the systems that do provide it.<br />

Security Services<br />

Single-machine operating systems provide some degree of security by relying on the characteristics of<br />

the hardware they run, and by leveraging the fact that the operating system trusts itself. Access control<br />

mechanisms for files, separation of data belonging to different processes, and authentication of users to<br />

the system work on these assumptions. In a distributed operating system, communications often go over<br />

insecure shared networks, and the remote operating systems might not be as fully trusted as the local<br />

system. The security problems are thus harder to solve, and distributed operating systems sometimes<br />

provide facilities to handle the problems.<br />

The use of an insecure network is typically handled by either authenticating or encrypting network<br />

traffic. A properly designed cryptographic system can usually make it difficult for outsiders to improperly<br />

inject or alter traffic, or to read secret information in transit. Such a cryptographic approach does not<br />

solve all problems, since one system must still rely on a remote system to enforce security restrictions<br />

just as the local system would. For example, if a sensitive file is stored at node A, when node B requests<br />

access to the file, node A can check that the request was made by a user with the right to view the file;<br />

however, if in response node A provides blocks of the file to the proper user on node B, node A must<br />

trust that node B will not maliciously or accidentally also provide the blocks to improper users. Node B<br />

has concerns, as well, because it cannot determine if node A has properly applied access control to the<br />

file. If node A has not done so, node B might provide its user with data that should be inaccessible. These<br />

concerns make it relatively difficult to set up a distributed operating system in environments where all<br />

participant systems do not completely trust one another.<br />

Assuming that the nodes are all trustworthy to the extent that they will properly handle data that they<br />

can properly access, the distributed system must still authenticate the requests from participants. Otherwise,<br />

one of the nodes in the distributed system might tag requests to remote nodes from user X with<br />

the identity of user Y, allowing X to access data improperly. The remote node must independently verify<br />

that the request really came from user Y. Many cryptographically based mechanisms can provide such<br />

authentication. One option is the Kerberos system, which allows machines in a distributed environment<br />

to authenticate identities and provide controlled access to services [5]. Security designers are generally<br />

happiest with heavily tested and used mechanisms, because they are less likely to have undiscovered<br />

security bugs, so Kerberos’ long history and the amount of scrutiny applied to it make it popular.<br />

35.4 Sample Distributed Operating Systems<br />

Locus<br />

The Locus Operating System was an early ambitious attempt to build a distributed operating system that<br />

provided all users with a single system image [6]. It was developed at UCLA and the Locus Computing<br />

Corporation throughout the 1980s and into the 1990s. Locus was intended to be Unix-compatible, both<br />

in terms of the operating system interface provided and the experience of users. Ideally, a Locus user<br />

would be given the illusion of a single large Unix system vastly more powerful than any single machine<br />

could provide. In actuality, the distributed operating system would run on each component node of the<br />

system. The nodes worked together to maintain the single image.<br />

The Locus system achieved some success, but ran into several problems that prevented it from becoming<br />

popular. The system demonstrated the value and feasibility of providing high transparency in a<br />

distributed operating system, and pioneered concepts such as file replication. But the challenges of providing<br />

© 2002 by CRC Press LLC

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!