SEC: object security

[Mike Prince]

On Tue, 1 Nov 1994, Francois-Rene Rideau wrote:

> If you do not trust a line, you should introduce encryption to secure it;
> but it will make things slower.
> As I already stated, we need maintain inter-host trust level, which
> should measure host and line security and reliability (i.e. chances of
> failure; chances of piracy); various checking should be done according to
> this trust level.

This stuff will come later, but might as well touch on it now...consider 
it light reading.

Each workspace has x channels to other workspaces.  Each channel (modem, 
LAN, disk drive) should be assigned a "trust" level.  Agents will only 
travel channels of a preset trust level or higher.

x before agent is the minumum trust level.
y before line is the trust level.

For instance, I'm buying something, the card reader machine grabs some 
info, sends an 5agent to the bank on a "secure" phone 7line.  The bank, 
in order to process my request passes my agent on to a verification 
service over the nebulous network.  (I'm assuming that the bank doesn't 
do all the work internally, an issue I'll talk about some other time).  
The network has 10 different lines that can move the agent to the 
destination, but the agent will only travel lines of trust level 5 or 
greater.

We already have the same thing for people.  Just substitute verbal, 
mail, fax, phone for the lines.  If something is really important and 
private we might consider our own company PBX not secure enough, and go 
talk in person.  Computers need to be able to quantitate the security of 
their link resources.

Please don't mean to construe that I don't advocate encryption as well, I do.

Mike