example of evolution in action, a term first
introduced in 1981 by Larry Niven and Jerry Pournelle in their science fiction
book Oath of Fealty. It suggests a characteristic of certain situations
to anecdotally illustrate the evolutionary process itself.
So, as something
of an afterthought, within widespread, heterogeneous computer networks, the
consideration of the environment for interactions was ultimately focused on the
concept of security. As it is typically used, the word or concept of
security is a rather nebulous thing. Too often this ambiguity in meaning is by
design rather than through imprecise usage of language. The word is intended to
suggest the presence of characteristics that may not, in fact, be provided. We
would suggest that a better way to refer to the cumulative set of security
characteristics is through the concept of trust, but as we said, we’ll get to
that down the road a bit.
So, from this
beginning, the discussion in deployment circles tended to focus on security as
add-on capability that needed to be somehow attached to the network, rather
than a basic physiological requirement. In essence, the trust that should ensue
from a high degree of security became a higher level need to be fulfilled
somewhere in the protocol stack. So, at this point, we should consider the
various characteristics that comprise the amalgam called security.
Within the general field of physics, in the study of interactions among
particles, whether it be in the macroscopic world of classical mechanics or in
the sub-atomic world of particle physics, dealing with two particles at a time
is a more readily solved problem than is the situation when more than two
particles are involved. In general, the equations of motion for two-body
interactions offer exact solutions whereas three-body or higher groupings allow
only for approximate solutions. Consequently, one approach to the classical
many-body problem has been, historically, to break the problem down into a
multitude of two-body interactions. A very similar situation holds in the
interactions among people, which was the first guide to the behavior of
computer interactions.
Our model for the interactions among people is to view them as being
composed of transactions;
specifically, of two party transactions. We suggest that this definition
can be further refined to enumerate two very specific characterizations of a transaction.
First, a transaction is time limited and second, or perhaps the corollary, a
transaction has a well-defined beginning and a well-defined conclusion or
outcome. Within the world of computer systems and computer networks, we tend to
think in terms of a preferred environment in which we can conduct transactions.
Operating within some known security
infrastructure, the preferred transaction environment provides some degree
of the following characteristics:
- Privacy
- Authentication
- Authorization
- Information Integrity
- Transaction history providing non-repudiation
These five areas,
encompassed as they must be by some means of establishing their respective
characteristics, form the metric by which we judge the efficacy of the security
of computer systems and computer networks. It is in this playground that
personal electronic devices become the big kid players. So, what do these
characteristics really mean in the computer world? Well, they mean much the
same thing as they do in our everyday world, since these are also
characteristics that we must establish to some degree for any type of
interaction among people.
|