نبذة مختصرة : Protection in distributed systems is a complex problem: which entities of a distributed system can be trusted, and according to this trust, how can the whole system be protected? The approach adopted in this thesis consists in distinguishing two levels of protection : a global protection by means of a centralized authorization server and a local protection on each site of the system by means of a security kernel. The authorization server has the responsibility of managing all access rights to persistant entites of the system while each security kernel controls all accesses to local objects (either transient or persistent) and is furthermore responsible for managing access rights for local transient objects. An authorization scheme for distributed object systems is presented ("object" here refers to the object-oriented programming notion). This scheme allows the least privilege principle to be strictly respected, defines new access rights called symbolic rights and a new scheme of privilege delegation. This authorization scheme is described in the context of a discretionnary security policy and in the context of a multilevel security policy. A multilevel security model adapted to the object oriented programming paradigm is developped and presented in this thesis. An example of an implementation of this authorization scheme is finally detailed. ; La protection des systèmes répartis est un problème complexe : en quelles entités du système peut-on avoir confiance et étant donné cette confiance, comment assurer la protection du système global. L'approche adoptée dans cette thèse consiste à combiner d'une part une gestion globale et centralisée des droits d'accès aux objets persistants du système par un serveur d'autorisation et d'autre part une protection locale par un noyau de sécurité sur chaque site du système réparti. Ce noyau contrôle les accès à tous les objets locaux (persistants ou temporaires) et a de plus la responsabilité de la gestion des droits d'accès aux objets temporaires locaux. Un schéma ...
Processing Request
No Comments.