Reference Monitor, Single Sign On, and eDirectory

Abstract

Victor (2007) explained that within any operating system architecture; the reference monitor represents the watchdog to enforce an access control within the system, and act as a mechanism that validate a request for a subjects (e.g. users or process) to perform operations (e.g. write, or read) on objects (e.g. memory or files) within the system. The reference monitor is a concept that is used as design requirements that facilitate and help to implement the validation mechanism within any system. Some of the characteristics of such mechanism are:

  • The reference monitor must always intervene when a request is made from the subject to the object.
  • The reference monitor can’t be interfered with or changed (Tamper-proof).
  • The reference monitor should be convenient enough to be subjected to the analysis and the tested required by the system.

A good example for an operating system that was built with such validation mechanism that follows the reference monitor concept is Windows NT, Windows XP, and Windows 2000. With such validation mechanism the system will ensure that any operation request within the system will be validated within the system, and follows the system’s access control policy designed to provide safety and security to such system (Victor, 2007).

Single Sign-On (SSO) provides the system’s users with an external authentication via access control mechanism that allow them to log in once to the system, and gain access to multiple systems’ resources and applications without being prompted to gain access within network systems again. Such mechanism leverages the security level within any organization, and also eliminates the challenges posed by many distributed environment within any organization. Within distributed system environment, independent security domain is implemented within system most of the time, and with implementing the SSO concept, such mechanism will be treated within the distributed systems as one single security domain, that can provide the simplicity of authentications management, and provide ease of access to the users of such systems (Shimonski, 2008).    

Similarity between the reference monitor, and the single sign-on mechanisms, exist within the concept where both mechanisms provide the access control mechanism that authorize the system’s users to gain access to certain resources within the network. 

Novell eDirectory (also known as Novell Directory Services ‘NDS’) was represented to provide a central access point for the resources within multiple servers and computers within a specific network where the assets represented in a logical tree that represents the objects that can be accessed by the network users. With eDirectory network resources are represented as objects in the directory, and such objects can be presented within the directory as leaf objects or containers, and each object is associated with property or attributes that can represent the access rights to each object with the directory (Novell, 2002).

Reference Monitor

When there is a request from a subject to an object within the system, reference monitor will validate the request, and allows the access if it’s safe to proceed. The reference monitor can be built from a single piece of code or module to a collection of access controls mechanism for various objects within the system such as files, memory, and CPU time. Reference monitor mechanism not only built to secure systems but also required authentication, identification, auditing and configuration. Such mechanism should be built on a generic security concept that can give a better security implementation within the system. Implementing a security reference monitor within any system will ensure that the proper authorization are available within the subject before granting access to an object, and also implement an auditing functionality that can track down the attempts of accessing an object (Victor, 2007).

Victor (2007) explained that reference monitor is known as reference validation mechanism or access control mechanism within any computing system, and it establishes the rules where the users can access safely the protected resources of such system, and some of these rules are:

  • It’s not allowed for users to modify the operating system.
  • It’s not allowed for user change the operating system within the system.
  • It’s not allowed for user to misuse the operating system within the system.

Locasto (2008) explained that the reference monitor provides the trusted environment that measure a set of properties that related to security, and also it provides the low-complexity that can create such trusted environment within any computing system, and with the increase of the adoption of virtualization environment within many organizations, reference monitor mechanism provides the a natural place for implementation within the virtualization environment.

Sign-On Systems Concept

Dunne (2003) explained that authentication within distributed systems that requires users to gain access to the system resources via username and password represent a complex problem since such systems has back-ends that support many portal applications within the distributed systems, and yet every applications and network has underlying security infrastructures that can be different from one network to another. To eliminate such hurdles, the implementation of the single sign-on within such distributed system will allow user to be authenticated across multiple applications with one single logon. Such technique provides a unified mechanism to manage users’ access control, and also maintain such information within one repository. Some of the benefits and also the risk that single sign-on can impose are:

  • The SSO mechanism improves the productivity of the users since users are no longer required to log into different systems, and networks via different authentication rules.
  • The SSO mechanism improves the developer productivity since the authentication is provided to them through a common framework that doesn’t need to be replicated in each application.
  •  The SSO mechanism reduces the administration work; since managing users through different repository is no longer exist.
  • The SSO is difficult to implement with many of the existing application, and represent a time consuming when it comes to implement such mechanism.
  • With multiple logons, the users can only log in into one system at a time, and as such; the risk of comprising the security of a system will be minimal to such system. On the other hand, the risk of an attacker to gain access via user password, will give the leverage to attack many systems within the organization.
  • The SSO mechanism is an attractive place for the attacker since it represents a single point of attack within any system that provides a repository of all the systems users’ authentications.

eDirectory Pros-Cons

eDriectory represents the same concept that the reference monitor represents where managing access to resources are provided by both mechanism. Also, both maintain a central repository (database) that is used to represent certain objects within the systems. However, eDirectory represent the objects in hierarchical presentation with each object have its own properties that define the access control rules that can be implemented for such object.

Clarke (2004) explained that with eDirectory tree, the structure presentation of such tree can be based on organization, location or administration or a combination of the above three, and as such; it’s imperative before designing such tree, to conduct a process to study the organization resources allocations and work group.  The eDirectory tree provides the following benefits:

  • System resources will be easy to access by users.
  • It provides an easy way of managing resources by network administrators.
  • It maintains a fault tolerance for the eDirectory database.
  • It reduces the network traffic.

With such mechanism each object within the eDirectory must be unique, and it identifies its location within the hierarchical tree since such name can impact the login process into the system and the recourse access within such mechanism (Clarke, 2004).

TheNerd(2008) explained that some of the pros and cons of the eDirectory are:

  • With the logical design of the eDirectory the objects within any system is easy to understand.
  • Administrating the users’ accounts within such mechanism is easy to access, and it’s easy to understand.
  • With less popularity of the eDirectory compare to the Microsoft Windows (Active Directory), it has less malwares and viruses that attack the vulnerabilities within the system.
  • Problem might happen when the system sometimes fails to synchronize properly.
  • It is found to be harder to find the drivers that can support the hardware that are used within Novell systems.
  • Novell client on the desktop represent an overhead to the users’ desktop, and it is hard to upgrade and be managed.
  • Performance issues that can impose difficulties to manage the system such as slow queries and database speed problem. However, these problems can be solved by indexing to speed up queries, and also using database caching to speed up the queries process.

Conclusion

The reference monitor concept is used to build a validation mechanism within any operating systems that can enforce the system’s access control policy. Such mechanism will be invoked to interfere with any operation that is sensitive to the security policy, and also to ensure that such policy have been followed during such operation. The reference monitor provides the means of checking if the subject is allowed to access an object within the system, and it is known as reference validation mechanism or access control mechanism (Yan and Fong, 2009).

Without a clear unified strategy to authenticate and authorize users, developers will re-implement custom security authentication within each network application in a distributed systems, and as such; such systems will lack scalability and introduce maintenance problems. With a single sign-on solution, the unified security and authentication framework can be delivered, and achieved to eliminate the above problem and take some of the burden that users might face in the distributed systems, reduce the administration work, and eliminate the work required to provide an authentication mechanism for each applications within the distributed systems (Dunne, 2003).

Finally, eDirectory represents another access mechanism that allows users to access the network resources via tree hierarchal mechanism where each object is represents as leaf with a property or attributes (Novell, 2002). 

References

Clarke, D. (2004) CAN Study Guide: Novell eDirectory [Online]. Available from: http://www.informit.com/articles/article.aspx?p=169521&seqNum=5 (Accessed: 28 November 2010).

Dunne, C. (2003) Build and implement a single sign-on solution [Online]. Available from: http://www.ibm.com/developerworks/web/library/wa-singlesign/ (Accessed: 28 November 2010).

Locasto, M. (2008) Rough Mix: Re-thinking the Combination of Reference Monitor and Resource Provider [Online]. Available from: http://www.govirtual.org/blogs/angelos/tags/reference_monitor (Accessed: 28 November 2010).

Novell (2002) eDirectory for the Beginner [Online]. Available from: http://developer.novell.com/education/tutorials/edirectory/edirectory.pdf (Accessed: 28 November 2010).

Shimonski, R. (2008) Enable Single Sign-On (SSO) for Windows Server 2008 Terminal Services [Online]. Available from: http://www.virtualizationadmin.com/articles-tutorials/terminal-services/security/enable-single-sign-on-sso-windows-server-2008-terminal-services.html (Accessed: 28 November 2010).

TheNerd (2008) Pros and Cons of Novell’s Netware and Related Services [Online]. Available from: http://www.themadfatter.com/2008/02/13/pros-and-cons-of-novells-netware-and-related-services/ (Accessed: 28 November, 2010).

Victor, B. (2007) Reference Monitors [Online]. Available from: http://www.it.uu.se/edu/course/homepage/sakdat/ht07/overview/monitors (Accessed: 28 November 2010).

Yan, F. & Fong, P. (2009) Secure Optimization of Inlined Reference Monitors [Online]. Available from: http://pages.cpsc.ucalgary.ca/~pwlfong/Pub/fei-fong-2009-manuscript.pdf (Accessed: 28 November 2010).

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: