A Practical Formal Model for Safety Analysis in Capability-Based Systems

Abstract

Abstract. We present a formal system that models programmable abstractions for access control. Composite abstractions and patterns of arbitrary complexity are modeled as a configuration of communicating subjects. The subjects in the model can express behavior that corresponds to how information and authority are propagated in capability systems. The formalism is designed to be useful for analyzing how information and authority are confined in arbitrary configurations, but it will also be useful in the reverse sense, to calculate the necessary restrictions in a subject's behavior when a global confinement policy is given. We introduce a subclass of these systems we call "saturated", that can provide safe and tractable approximations for the safety properties in arbitrary configurations of collaborating entities.

Reasoning about Object Capabilities with Logical Relations and Effect Parametricity

“…The problem is that previous research (except Spiessens [10], [11], but see Section 7) focuses on reference graph dynamics. For a state in a program's execution, the reference graph is the graph with the allocated objects as nodes, and the references they hold to each other as edges.…”

Capabilities for information flow

“…They discuss examples when, using data diodes, capabilities can help guarantee the mandatory access-control discipline no write down in the Bell-LaPadula model. In a similar vein, Spiessens and Van Roy [45] spell out the examples from [35] in a more abstract setting.…”

An Overview of the Annex System

“…The semantics of the underlying security model are encapsulated in a few simple rules. Hence, the model and its implementation lend themselves to formal analysis [27], which we believe will allow Annex to provide very strong security guarantees.…”