To make rights available to a potential caller, the owner of an object gives it an unforgeable credential that lists the rights granted. When the caller invokes a method on the object, it presents the appropriate credential to MayI, which then checks the scope and authenticity of the credential. Alternatively, the owner of an object can semipermanently assign a set of rights to a particular caller or group. MayI's responsibility is then to confirm the identity of the caller and its membership in one of the allowed groups, followed by comparing the rights authorized with the rights required for the method call. The means for establishing identity in Legion also address the requirement for protecting communications between objects.
Objects can use the public key of a target object to encrypt their communications to it.
Likewise, an object's private key can be used to sign messages, providing authentication and nonrepudiation. If an intruder tries to tamper with the public key of a known object, it will create a new name that is unknown. The combined components of the security model encourage the creation of a large-scale Legion system with multiple overlapping trust domains. Each domain can be separately defined and controlled by the users it affects. When difficult problems arise such as merging two trust domains, Legion provides a common and flexible context in which they can be resolved.