The Internet architecture scales to large numbers of hosts, and an increasing number of host types, as a consequence of the ``end-to-end'' rule-of-thumb, which states roughly that functions which must be performed at endpoints should be performed there, and not in the network. Security, and more specifically, access control, being an end-to-end requirement, would be performed at hosts using the end-to-end model as a design principle. A risk, however, is that a principle for achieving scalability may cause a tension with security design principles. In particular, an increasing concern is the effect that insecure applications (such as mailers and browsers tightly integrated into host operating systems) can have on other applications, and further, on hosts elsewhere in the network. Such applications have been repeatedly exploited.

One approach to the problem of insecure applications damaging networks is the use of network access control, enforced by a boundary controller such as an application gateway or firewall. While this approach is popular and widely deployed, it suffers from three major problems: (1) firewalls are difficult to administer; (2) topological restrictions must be used to ensure that policies are enforced; and (3) at best, they provide only a rough (and often incorrect) approximation of the access control desired by applications. Additional negative effects of firewalls include interference with routing and congestion control algorithms which are otherwise rather effective.

GRIDLOCK is an approach that, simultaneously, provides more security to applications, greater scalability, and unification of network access control and host access control. Policies are specified in a new policy-expression language, modeled on the KeyNote language we developed for trust management. This design, like KeyNote, supports compliance checking, with which credentials provided by a client can be validated to provide access to a resource. Our hypothesis is that this approach can be used for both boundary controllers (where we have some preliminary evidence of success) and simultaneously in hosts. If we are correct, as this research is intended to demonstrate, then untrusted code, such as that attached to e-mails, will be treated as such by the host, as it will lack any credentials permitting access to anything but the simplest of host resources. Our belief is that this layer-crossing approach to security will lead to the creation of a multiplicity of virtual private services.

Our approach is to combine the development of formal semantics for the unified access control policy with a rigorous experimental investigation of the approach, using multiple example applications.

The GRIDLOCK project is supported by the NSF Trusted Computing program, under Contract CCR-TC-0208972.