Butler Lampson, Martín Abadi, Michael Burrows, and Edward Wobber
We describe a theory of authentication and a system that
implements it. Our theory is based on the notion of principal
and a ‘speaks for’ relation between principals. A simple
principal either has a name or is a communication channel; a
compound principal can express an adopted role or delegated
authority. The theory shows how to reason about a principal’s
authority by deducing the other principals that it can speak
for; authenticating a channel is one important application. We
use the theory to explain many existing and proposed security
mechanisms. In particular, we describe the system we have built.
It passes principals efficiently as arguments or results of
remote procedure calls, and it handles public and shared key
encryption, name lookup in a large name space, groups of
principals, program loading, delegation, access control, and
revocation. In ACM Transactions on Computer Systems Publisher
Association for Computing Machinery, Inc. Copyri