A Password-Capability System

Anderson, M. Robin; Pose, Ronald; Wallace, Chris S.

doi:10.1093/comjnl/29.1.1

Cited by 70 publications

(44 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Password capabilities are an important improvement to the original capability concept [1,3,10,20]. The password-capability paradigm associates one or more passwords with each given object.…”

Section: Capabilities and Password Capabilitiesmentioning

confidence: 99%

Object protection in distributed systems

Lopriore

2013

Journal of Parallel and Distributed Computing

View full text Add to dashboard Cite

a b s t r a c tWith reference to a distributed system consisting of nodes connected by a local area network, we consider a salient aspect of the protection problem, the representation of access permissions and protection domains. We present a model of a protection system supporting typed objects. Possession of an access permission for a given object is certified by possession of an object pointer including the specification of a set of access rights. We associate an encryption key with each object and a password with each domain. Object pointers are stored in memory in a ciphertext form obtained by using the object key and including the value of the domain password. Each process is executed in a domain and can take advantage of a given object pointer only if this object pointer was encrypted by including the password of this domain. A set of protection primitives makes it possible to use object pointers for object reference and to control the movements of the objects across the network. The resulting protection environment is evaluated from a number of salient viewpoints, including ease of access right distribution and revocation, interprocess interaction and cooperation, protection against fraudulent actions of access right manipulation and stealing, storage overhead, and network traffic.

show abstract

Section: Capabilities and Password Capabilitiesmentioning

confidence: 99%

Object protection in distributed systems

Lopriore

2013

Journal of Parallel and Distributed Computing

View full text Add to dashboard Cite

show abstract

“…The Annex system comprises a number of devices, each of which hosts their own object-capability implementation in which password capabilities [2] provide a universal capability representation. Each Annex user is assigned their own device, which is irreversibly bound to their identity.…”

Section: Expressing Credentialsmentioning

confidence: 99%

Non-delegatable authorities in capability systems

Murray

Grove

2008

JCS

View full text Add to dashboard Cite

We present a novel technique, known as the non-delegatable authority (NDA), for distributing authority to unconfined subjects in capability systems that prevents them from sharing the exact same authority that they have been given with anyone else. This feature is present in common systems based on access control lists (ACLs) in which one may hand out a permission without handing out the associated "grant" right, but has been thought to be impossible to express in capability systems until now. Consequently, we demonstrate that NDAs may be used to express ACL-like constructs and their basic pattern is directly applicable for implementing Multi-Level Security and identity-based access controls in the object-capability model.The extra complexity introduced by our NDA implementation can be hidden behind constructs that allow NDAs to be wielded as if they were ordinary capabilities to the target resource. These constructs cannot break the non-delegatability constraint and allow NDAs to be used effectively, although with less efficiency than delegatable authorities.

show abstract

“…interface TellerAccess { void deposit(Key key, Currency amount); void withdraw(Key key, Currency amount) throws insufficientFunds; Currency balance(Key key); String getName(Key key); void transfer(Key key, Key toKey, Currency amount) throws insufficientFunds; 1 As well as increasing security, it also simplifies the use of the object by the user if only the relevant methods are visible. instead of the type Accounts.…”

Section: Extending Access Controlmentioning

confidence: 99%

“…A number of possible alternatives have been suggested for implementing capabilities. These include special architectures [24], encryption [23] and sparse (or password) capabilities [1]. We base our mechanism on sparse capabilities since these require no special architecture or costly encryption algorithms and also because they alleviate the revocation problem.…”

Section: A Flexible Access Control Mechanismmentioning

confidence: 99%

Supporting parameterised roles with object-based access control

Evered

2003

36th Annual Hawaii International Conference on System Sciences, 2003. Proceedings of The

View full text Add to dashboard Cite

The per-method access control lists of standard internet technologies allow only simple forms of access control to be expressed and enforced. They also fail to enforce a strict need-to-know view of persistent data. Real applications require more flexible security constraints including parameter restrictions, logging of accesses and state-dependent access constraints. In particular, the concept of parameterised roles, central to a fine-grained specification of access rules and compliance with privacy laws, should be supported in a natural way. In this paper we demonstrate how an object-based approach using the mechanism of bracket capabilities can be used to enforce various kinds of access constraints including discretionary, mandatory and parameterised role-based access control. We give examples from a health information system incorporating secure patient access and secure access by appropriate medical and administrative personnel.

show abstract

A Password-Capability System

Cited by 70 publications

References 0 publications

Object protection in distributed systems

Object protection in distributed systems

Non-delegatable authorities in capability systems

Supporting parameterised roles with object-based access control

Contact Info

Product

Resources

About