Kerberos: An Authentication Service for Open Network Systems

TLDR

In open network computing, workstations cannot be trusted to correctly identify users to network services. The paper provides an overview of the Kerberos authentication model implemented for MIT's Project Athena. Kerberos uses a trusted third‑party authentication service with client, server, and Kerberos protocols, database management and replication, and is integrated into Athena with interfaces for users, programmers, and administrators and a range of applications. The paper demonstrates integrating Kerberos into the Sun Network File System as a case study.

Abstract

In an open network computing environment, a workstation cannot be trusted to identify its users correctly to network services. Kerberos provides an alternative approach whereby a trusted third-party authentication service is used to verify users' identities. This paper gives an overview of the Kerberos authentication model as imple- mented for MIT's Project Athena. It describes the protocols used by clients, servers, and Kerberos to achieve authentication. It also describes the management and replication of the database required. The views of Kerberos as seen by the user, programmer, and administrator are described. Finally, the role of Kerberos in the larger Athena picture is given, along with a list of applications that presently use Kerberos for user authentica- tion. We describe the addition of Kerberos authentication to the Sun Network File Sys- tem as a case study for integrating Kerberos with an existing application.