...
If we don't trust the network, we'll likely need heavy crypto, which is contrary to our performance goals.
Authentication Proposal
Performance is paramount, so we must ensure that authentication and access control mechanisms are efficient (in time and space).
Two isomorphic proposals work as follows:
- Clients authenticate with an authorization service and are returned a >= 64-bit secret.
- The secret is passed with each RPC. Masters verify the secrets with the authentication services and cache results in a hash table for speed.
- Clients authenticate with an authorization service, but are returned an encrypted or signed token that identifies their principal. The master can verify the self-certifying token and need not contact the authorization service itself.
Trade-offs between the two are size of the secret or tokens and the cost of crypto vs. a hash table lookup (the former may be very fast due to data being in cache and new SSE AES instructions, the latter will likely not miss the cpu cache due to a high level of temporal locality in accesses and a relatively small number of principals accessing each machine).
Protection Granularity
Two obvious choices:
...