Monographs in Computer Science Editors David Gries Fred B. Schneider Springer New York Berlin Heidelberg Hong Kong London Milan Paris Tokyo Andrew Herbert Karen Spa¨rck Jones Editors Computer Systems Theory, Technology, and Applications A Tribute to Roger Needham With 110 Illustrations Andrew Herbert Karen Spa¨rck Jones Microsoft Research Ltd. Computer Laboratory Roger Needham Building University of Cambridge 7 JJ Thomson Avenue JJ Thomson Avenue Cambridge CB3 0FB Cambridge CB3 0FD UK UK Series Editors: David Gries Fred B. Schneider Department of Computer Science Department of Computer Science The University of Georgia Cornell University 415 Boyd Graduate Studies 4115C Upson Hall Research Center Ithaca, NY 14853-7501 Athens, GA 30602-7404 USA USA Library of Congress Cataloging-in-Publication Data Herbert, A.J. (Andrew J.), 1954– Computer systems: theory, technology, and applications/[edited by] Andrew J. Herbert, Karen I.B. Spa¨rck Jones p. cm. — (Monographs in computer science) Includes bibliographical references. ISBN 0-387-20170-X (alk. paper) 1. System design. 2. Computer science. I. Spa¨rck Jones, Karen I.B. II. Needham, R.M. (Roger Michael) III. Title. IV. Series. QA276.9.S88H45 2004 005.1′2—dc21 2003066215 ISBN 0-387-20170-X Printed on acid-free paper. © 2004 Springer-Verlag New York, Inc. All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer-Verlag New York, Inc., 175 Fifth Avenue, New York, NY 10010, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or here- after developed is forbidden. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. Printed in the United States of America. (SBA) 987654321 SPIN 10944769 Springer-Verlag is part of Springer Science+Business Media springeronline.com Roger Needham 1935 – 2003 Contents Preface xi Roger Needham: 50 + 5 Meeting Programme xiii Contributors xv Introduction: Roger Needham Rick Rashid 1 1 On Access Control, Data Integration, and Their Languages Martín Abadi 9 2 Protocol Analysis, Composability and Computation Ross Anderson, Michael Bond 15 3 Access Control in Distributed Systems Jean Bacon, Ken Moody 21 4 Implementing Condition Variables with Semaphores Andrew D. Birrell 29 5 Clumps, Clusters and Classification Christopher M. Bishop 39 6 How to Implement Unnecessary Mutexes Mike Burrows 51 7 Bioware Languages Luca Cardelli 59 8 The Economics of Open Systems David D. Clark 67 9 From Universe to Global Internet Jon Crowcroft 73 10 Needham-Schroeder Goes to Court Dorothy E. Denning 77 11 The Design of Reliable Operating Systems Peter Denning 79 12 An Historical Connection between Time-Sharing and Virtual Circuits Sandy Fraser 85 13 On Cross-Platform Security Li Gong 89 14 Distributed Computing Economics Jim Gray 93 15 The Titan Influence David Hartley 103 16 Middleware? Muddleware? Andrew Herbert 109 17 Grand Challenges for Computing Research viii Contents Tony Hoare 117 18 Sentient Computing Andy Hopper 125 19 Cyber Security in Open Systems Anita Jones 133 20 Software Components: Only the Giants Survive Butler W. Lampson 137 21 Security Protocols: Who Knows What Exactly? Peter Landrock 147 22 Volume Rendering by Ray-Casting in Shear-Image Order Hugh C. Lauer, Yin Wu, Vishal Bhatia, Larry Seiler 153 23 A Conceptual Authorization Model for Web Services Paul J. Leach, Chris Kaler, Blair Dillaway, Praerit Garg, Brian LaMacchia, Butler Lampson, John Manferdelli, Rick Rashid, John Shewchuk, Dan Simon, Richard Ward 165 24 The Trouble with Standards E. Stewart Lee 173 25 Novelty in the Nemesis Operating System Ian Leslie 177 26 A Technology Transfer Retrospective Roy Levin 185 27 An Optical LAN Derek McAuley 195 28 What’s in a Name? Robin Milner 205 29 The Cryptographic Role of the Cleaning Lady Bob Morris 211 30 Real Time in a Real Operating System Sape J. Mullender, Pierre G. Jansen 213 31 Zen and the Art of Research Management John Naughton, Robert W. Taylor 223 32 The Descent of BAN Lawrence C. Paulson 225 33 Brief Encounters Brian Randell 229 34 Retrieval System Models: What’s New? Stephen Robertson, Karen Spärck Jones 237 35 Slammer: An Urgent Wake-Up Call Jerome H. Saltzer 243 36 Caching Trust Rather Than Content M. Satyanarayanan 249 37 Least Privilege and More Fred B. Schneider 253 38 Using Sharing to Simplify System Management Michael D. Schroeder 259 Contents ix 39 An RSA-Related Number-Theoretic Surprise Gustavus J. Simmons 269 40 Application-Private Networks Jonathan M. Smith 273 41 Using the CORAL System to Discover Attacks on Security Protocols Graham Steel, Alan Bundy, Ewen Denney 279 42 On the Role of Binding and Rate Adaptation in Packet Networks David Tennenhouse 287 43 Technologies for Portable Computing Chuck Thacker 295 44 Multiple Alternative Voting David Wheeler 305 45 The Semiotics of Umbrellas John Wilkes 311 46 Computers for Specialized Application Areas Maurice Wilkes 317 Computer Security? Roger Needham 319 Roger Needham: Publications Karen Spärck Jones 327 Preface Roger learnt that he was seriously ill late in December 2002. When he heard this, Rick Rashid, Microsoft Senior Vice-President for Research, suggested that there should be some occasion to mark Roger’s contribution to the field, and an asso- ciated publication. In response, we proposed a one-day meeting with both technical talks and a more personal session about Roger, with the presentation of a volume of papers from Roger’s many technical colleagues as the key element. There was not much time to prepare the volume. So we asked for short pa- pers on any technical topic of each contributor’s choosing likely to be of interest to Roger. The papers could be on an area of current research, a conjecture about the future, or an historical reflection. They had to be delivered in four weeks. We much appreciated the rapid and enthusiastic responses to our invitation, and were delighted with the range of topics covered and their technical interest. We were also grateful, as each editor reviewed all the papers, for the positive spirit with which our comments and suggestions were received. The meeting itself, ‘Roger Needham: 50 and 5,’ marking Roger’s fifty years in Cambridge and five at Microsoft Research, took place on February 17th, 2003. The programme is given, for reference, following this Preface. The entire proceedings were recorded, publicly available at: http://www.research.microsoft.com/needhambook We would like to thank all those who wrote for the volume, and those who spoke at the meeting. We know that Roger was very touched by how many came to the meeting, some from far away, by how many wrote for the volume and in doing so re- sponded to his interests, by the references to his work in the technical talks, and by the accounts of his roles and contributions in the presentation session. At the end of the meeting he said: The first thing to say is thank you very much—which is sort of obvious. The next thing I want to say is one or two words about what I’ve done and what my subject is. In many sorts of engineering the theoretical background is obvious: it’s continuous mathematics which comes from the 18th century. In computing there is a theoretical background and it’s not obvious but it had to be invented, and people in the theoretical part of our subject have devoted themselves to inventing it—which is fine because you can’t expect it to hap- pen by itself and you can’t go and build computer systems with any complex- ity at all without some formalised understanding to fall back on. xii Preface It is an odd thing that in my career I have contributed one or two bits to that, but that’s basically not what I’m about. I have the greatest respect for the people who build the theoretical underpin- nings of our subject, and I wish them every success because it will enable the people who want to get on and make things to do it better and to do it more quickly and to do it with less mistakes—and all of this is good: but at the end of the day I am a engineer— and so saying, he put on his engineer’s hard hat. He died less than two weeks later, on March 1st. Roger’s last major talk was his Clifford Paterson Lecture ‘Computer secu- rity?’ at The Royal Society in November 2002. We have included its text, which is also posthumously published in the Society’s Philosophical Transactions,as the last paper in the volume, along with a complete list of Roger’s publications. We have used the classic Needham-Schroeder authentication protocol as the cover design. The papers in this volume are as they originally appeared for the meeting, apart from some minor corrections and some small modifications, necessary in the circumstances, to specific references to Roger. These papers address issues over the whole area of computer systems, from hardware through operating systems and middleware to applications, with their languages and their implementations, and from devices to global networks; also from many points of view, from designers to users, with lessons from the past or concerns for the future. Collectively, they illustrate what it means to be a com- puter system. Acknowledgements We are very grateful to Microsoft for supporting the celebration meeting itself, producing the volume in its original form, and for further supporting the prepara- tion of the volume for formal publication.