\documentstyle{article}
\setlength{\oddsidemargin}{0in}
\setlength{\evensidemargin}{0in}
\setlength{\topmargin}{-2pc}
\setlength{\headheight}{1pc}
\setlength{\headsep}{2pc}
\setlength{\textwidth}{6.5in}
\setlength{\textheight}{8.5in}
\setlength{\parskip}{.1in}
\setcounter{tocdepth}{3}

\begin{document}

\section{Description field in satchel ditched}

I found that it really wasn't justified; if applications wish to supply
a description of the contents, they should do so either inside the
encrypted message, if they wish it to be secret, or outside of the
satchel, if they intend it to be publically readable.  

If an application really requires that the description be only readable
by a select list of principals which is different from the people who
can read the message data, it should prepare a separate satchel (using a
different compartment) containing the description.  I don't forsee this
last situation arising very often, so we shouldn't include special-case
code in Nox to support having a description field.


\section{Extending the concept of ACL}

In order to allow for flexibility in controlling access to a
compartments, I propose the following extension:

The ACL for the compartment is modified so that instead of a bit for
each privilege (encrypt, decrypt, administer, etc.) we store an integer
which represents the number of ``voting rights'' the principal has for
that access right.  In addition, for each access right the compartment
stores the number of ``voting rights'' required to obtain the access
right.  By using proxies (defined below), multiple users can petition
for a request to be serviced by the Nox server.  This allows a
compartment to be set up so that certain requests can only be performed
when some number of users concur.

\section{Proxies}

If a user has the ``proxy'' priviliege, he may send to Nox a request
to generate a proxy packet.  This packet contains the following
information:

\begin{itemize}
\item The principal which issued the proxy.

\item The principal which is allowed to use the proxy.

\item The expiration time of the proxy.

\item A crypto checksum of the request for which the proxy is good for.

\item A list of the access rights which the issuer possesses, and how
many ``votes'' he is allocating to the principal which is performing the
specified request.
\end{itemize}

\section{Non-descretionary access control}

Non-descritionary access control is difficult to implement in a
distributed system where not all of the workstations can be fully
trusted.  This is one way to implement them.

Each host is assigned a security level (confidential, secret, top
secret, etc.)  Data which is in a satchel marked a level above the level
of the host will not be sent to that host.  In addition, requests from
the host can only create satchels which are at the security level of the
host or higher.  A host's security level can change only when an
administrator changes the level of a host and all the Nox servers are
notified of the change.

Each user has a list of categories and a security level.  A user can
only decrypt a message if his categories and security level dominates
those of the satchel.   (Of course, he will only be able to receive the
data if he is currrently running on a host which meets the requirements
stated in the last paragraph.)  A user can only create satchels whose
categories and security level is dominated by that of the user's
categories and security level.

\section{Example: Secret bank accounts}


\end{document}
