Capabilities and Identity in a Wide-Area File System

This paper describes the design, implementation, and performance of Neo, a wide-area file system whose security architecture is based on the chit. Chits are instantiations of capabilities that capitalize on the strengths of traditional capabilities (flexible granularity, rights tied to naming, non-traditional identities) while mitigating the drawbacks (revocation, accountability, lack of confinement). Neo allows flexible, fine-grained sharing with differing, chit-defined notions of identity. User-defined policies allow anonymous access, fully authenticated access, and levels in between. We describe the implementation of Neo, and show that the required mechanisms add little overhead to the underlying system.