Confused deputy problem
|
|
In information security, the Confused Deputy Problem is a canonical example of why capability-based security is important. A brief description of the involved elements follows.
| Contents |
The Deputy
The deputy is a program that is called upon (deputized) by a client to perform some action and at the same time granted by the client temporary authority to take that action. The client provides a name of a resource upon which to take the action. The deputy has additional built-in authority to take other actions that are a necessary part of its job.
A classic example is the UNIX passwd command, used to change a user's password, which has access to the password file, although the user invoking it does not.
The Confused Deputy
The client names a resource to which it lacks authority. The deputy attempts its normal act on the resource named by its client. The deputy's act is permitted by security mechanisms because the deputy's built-in authority is sufficient for this act. The deputy has unwittingly abetted an indirect action by its client that the security rules were designed to prevent. The deputy has unwittingly abused its own built-in authority. The deputy is blameless if the semantics of the system did not allow it to say that the act was to be subject to its client's authority.
Continuing with the passwd example, the passwd command has an option to change another user's password, and indeed it has the authority to alter the other user's password on its client's behalf. Only careful checking by passwd itself avoids this security hole.
Capability style solution
Capabilities solve this implicitly in that the name supplied by the client to the deputy is a capability which naturally includes the necessary authority. The deputy's action is via that capability. The client is unable to provide a capability that by hypothesis it lacks.
In our example, this would amount to a user only being able to modify their own entry in the password file, as well as any program they might run such as passwd having the same restriction.
External links
- The Confused Deputy, the original article describing the problem (http://www.cis.upenn.edu/~KeyKOS/ConfusedDeputy.html)