Extensible access control with authorization contracts

Abstract

Existing programming language access control frameworks do not meet the needs of all software components. We propose an expressive framework for implementing access control monitors for components. The basis of the framework is a novel concept: the authority environment. An authority environment associates rights with an execution context. The building blocks of access control monitors in our framework are authorization contracts: software contracts that manage authority environments. We demonstrate the expressiveness of our framework by implementing a diverse set of existing access control mechanisms and writing custom access control monitors for three realistic case studies.

An extended account of contract monitoring strategies as patterns of communication

“…After Findler & Felleisen (2002) brought software contracts into functional programming, a cottage industry of software contract verification techniques sprung up (Hinze et al, 2006;Findler et al, 2008;Degen et al, 2009;Dimoulas et al, 2009;Chitil, 2012;Dimoulas et al, 2013;Moore et al, 2016). Swords et al (2015) provides a framework for expressing their interactions, and we extend and revise that work.…”

“…Security Enforcement Contracts. Moore et al (2016) introduce contracts to model authorization and access control (Moore et al, 2016), which provide a domainspecific language for writing security-centric contracts. It is conceivable to recreate such behavior as a strategy with customized contract inputs, wherein the strategy inspects the structure of its contract and acts accordingly.…”

“…Researchers have proposed myriad contract enforcement strategies in response to these rising complexities, including lazy monitors (Degen et al, 2009;Chitil, 2012), concurrent monitoring systems (Dimoulas et al, 2009), optional enforcement (Dimoulas et al, 2013), and probabilistic contract verification (Moore et al, 2016;Hickey, 2018).…”

“…While modern contract software verification literature introduces a slew of such specifications (Ergün et al, 1998;Findler & Felleisen, 2002;Chitil et al, 2003;Hinze An extended account of contract monitoring strategies 3 et al., 2006;Degen et al, 2009;Disney et al, 2011;Chitil, 2012;Dimoulas et al, 2013;Keil & Thiemann, 2015;Moore et al, 2016;Hickey, 2018), each variation makes distinct decisions about the various trade-offs for verification, including…”

Extensible access control with authorization contracts

“…But a process can run on behalf of a different user if it runs an executable that has the setuid bit set. When a process invokes a setuid executable, the operating system launches a new process This technical report expands [30] with additional examples and code listings, along with a formal definition and proof of complete monitoring for the contract system described in Section 3. 1. to run the executable and associates the new process with the user that owns the executable, rather than the user that invoked it.…”