[Squeak-e] Paradigm Regained: Abstraction Mechanisms for Access Control

[Mark S. Miller]

At http://srl.cs.jhu.edu/pubs/SRL2003-03.pdf you will find the paper Shap 
and I just submitted for my invited talk at 
Asian'03 http://www.cse.psu.edu/asian03/ . We expect to hear back from 
referees on Sep 7, so we have one more round of revision to go before camera 
ready. Discussion would be most enjoyable and quite valuable. Thanks.

I'm cross-posting this message to cap-talk, e-lang, squeak-e, mozart-oz, and 
web-calculus, but let's discuss non-platform specific issues on cap-talk. 
(Please don't reply-all.)


Paradigm Regained: Abstraction Mechanisms for Access Control

Mark S. Miller, Jonathan S. Shapiro

Abstract

Access control systems must be evaluated in part on how well they support 
the Principle of Least Authority (POLA), i.e., how well they enable the 
distribution of appropriate access rights needed for cooperation, while 
simultaneously limiting the inappropriate proliferation of access rights 
which would create vulnerabilities. POLA may be practiced by arrangement of 
permissions and by abstraction of access. To date, access control systems 
have been evaluated only by their effectiveness at POLA-by-arrangement. 

Working in the original capability model proposed by Dennis and van Horn, we 
show how actual systems have used abstraction to enforce revocation, 
confinement, and the *-properties--policies whose enforcement has been 
"proven" impossible by arrangement-only analysis. To account for these 
abilities, analysis must also examine the behavior of security-enforcing 
programs (which are usually simple) to see how they limit the authority of 
arbitrarily complex untrusted programs. The original capability model, 
analyzed in these terms, is shown to be stronger than is commonly supposed. 


----------------------------------------
Text by me above is hereby placed in the public domain

        Cheers,
        --MarkM