IBM Research Report DeuTeRiuM - A System for Distributed Mandatory Access Control

We define and demonstrate an approach to securing distribute d computation based on a distributed, trusted reference monitor (DTRM) that enforces mandatory access control (MAC) polici es across machines. Securing distributed computation is difficult be cause of the asymmetry of trust in different computing environments and the complexity of managing MAC p olicies across machines, when they are already complex for one machine (e.g., Fedora Core 4 SELinux policy). We leverage recent work in three areas as a basis for our solution: (1) remote att est tion as a basis to establish mutual acceptance of reference monitoring function; (2) virtual m achines to simplify reference monitor design and the MAC policies enforced; and (3) IPsec with MAC l abels to ensure the protection and authorization of commands across machines. We define a di stributed computing architecture based on these mechanisms and show how local reference monit or guarantees can be attained for a distributed reference monitor. We implement a prototype s ystem on the Xen hypervisor with a trusted MAC VM built on Linux 2.6 whose reference monitor des ign requires only 13 authorization checks, only 5 of which apply to normal processing (others ar e fo policy setup). This prototype enforces MAC between machines using IPsec extensions that l abel secure communication channels. We show that, through our architecture, distributed comput ations can be protected and controlled coherently across all the machines involved in the computat ion.