digital identity security architecture in ethos
Certificate systems often provide a foundation for distributed system security. A certificate is a signed statement; the user's private key must have been used to create the certificate's signature and the resulting certificate is tamper evident. Despite being based on sound theory, certificate system implementations are often exploited. Furthermore, certificate systems are often complex, to the extent that user-space programmers avoid certificates in favor of less secure, but easier to program, mechanisms. We describe the certificate system for Ethos, an experimental OS that has been designed for security from the ground up. We reexamine and redesign the layering of certificate creation across kernel and user space, and discuss the beneficial security properties that result. The design enables certificates to be a pervasive authentication mechanism, private keys to be protected, and policy-based restrictions on the statements that a given application may sign. These protections are essential to protect digital identity systems from attack.
digital identity certificate authentication authorization operating system