At http://srl.cs.jhu.edu/pubs/SRL2003-03.pdf you will find the paper Shap
and I just submitted for my invited talk at
Asian'03 http://www.cse.psu.edu/asian03/ . We expect to hear back from
referees on Sep 7, so we have one more round of revision to go before camera
ready. Discussion would be most enjoyable and quite valuable. Thanks.
I'm cross-posting this message to cap-talk, e-lang, squeak-e, mozart-oz, and
web-calculus, but let's discuss non-platform specific issues on cap-talk.
(Please don't reply-all.)
Paradigm Regained: Abstraction Mechanisms for Access Control
Mark S. Miller, Jonathan S. Shapiro
Abstract
Access control systems must be evaluated in part on how well they support
the Principle of Least Authority (POLA), i.e., how well they enable the
distribution of appropriate access rights needed for cooperation, while
simultaneously limiting the inappropriate proliferation of access rights
which would create vulnerabilities. POLA may be practiced by arrangement of
permissions and by abstraction of access. To date, access control systems
have been evaluated only by their effectiveness at POLA-by-arrangement.
Working in the original capability model proposed by Dennis and van Horn, we
show how actual systems have used abstraction to enforce revocation,
confinement, and the *-properties--policies whose enforcement has been
"proven" impossible by arrangement-only analysis. To account for these
abilities, analysis must also examine the behavior of security-enforcing
programs (which are usually simple) to see how they limit the authority of
arbitrarily complex untrusted programs. The original capability model,
analyzed in these terms, is shown to be stronger than is commonly supposed.
----------------------------------------
Text by me above is hereby placed in the public domain
Cheers,
--MarkM
