Security and Protection in Timor Programs.

Abstract

Timor offers a wide variety of security and protection features which are not available in other programming languages. A basic capability mechanism allows access to the methods associated with a Timor persistent file or a local internal object to be selectively controlled. A general qualifier mechanism allows arbitrary checks to be programmed both before methods are invoked and when they attempt to invoke other methods. This enables mechanisms such as access control lists, capability revocation lists and password checking to be applied to some or all the method invocations on an object, and can also be used for example to encrypt parameters. Since such qualifiers can be arbitrarily programmed they can also easily provide rule-based access controls. Mechanisms are also provided to allow objects with which users entrust their information to be confined. Finally, it is possible to program authentication objects which can provide arbitrary checks to establish the identities of users as they log in.

Persistent Processes and Distribution in Timor.

“…The Timor concept of persistent processes has a significant advantage over process concepts of other programming languages (leaving aside the protection advantages discussed in [12]), viz. distribution is genuinely invisible to the user (unless he specifically wants to know about the locations of his objects) without affecting the semantics of the language.…”

“…In view of the advantages of the in-process model which have been outlined in this section, Timor rigorously supports the in-process model. This provides Timor with a significant protection (and monitoring) advantage over other OO programming languages [12]. However, for those convinced of the advantages of the out-of-process model, Timor is not a hindrance, because it is easy to simulate the out-of-process model in an in-process system.…”

“…Executing code can obtain the owner identifier of the objects in his current environment, including the owner of the current process and current file. This can be used for example for carrying out protection checks (see [12]).…”

“…One consequence of this distinction is that the protection advantages of the inprocess model discussed in [12] are not readily available in Java (and could not be made readily available without considerable programming effort and run-time cost). In particular Java does not (and could not, without considerable run-time overhead) provide a mechanism which uniquely identifies the user associated with an active process (in contrast with Timor, see section 3).…”

“…www.speedos-security.org8 One key reason for this is that it supports a number of protection facilities[12] …”