Programming frameworks are an accepted fixture in the
 object-oriented world, motivated by the need for code reuse,
 developer guidance, and restriction. A new trend is emerging where
 frameworks require domain experts to provide declarations using a
 domain-specific language (DSL), influencing the structure and
 behaviour of the resulting application. These mechanisms address
 concerns such as user privacy. Although many popular open platforms
 such as Android are based on declaration-driven frameworks, current
 implementations provide ad hoc and narrow solutions to concerns
 raised by their openness to non-certified developers. Most widely
 used frameworks fail to address serious privacy leaks, and provide
 the user with little insight into application behaviour.

 To address these shortcomings, we show that declaration-driven
 frameworks can limit privacy leaks, as well as guide developers,
 independently from the underlying programming paradigm. To do so,
 we identify concepts that underlie declaration-driven frameworks,
 and apply them systematically to both an object-oriented language,
 Java, and a dynamic functional language, Racket. The resulting
 programming framework generators are used to develop a prototype
 mobile application, illustrating how we mitigate a common class of
 privacy leaks. Finally, we explore the possible design choices and
 propose development principles for developing domain-specific
 language compilers to produce frameworks, applicable across a
 spectrum of programming paradigms.

background

/pdf/frameworks-compiled-from-declarations-a-language-independent-1r1lpv3tap.pdf

Capability-Based Computer Systems

Frameworks compiled from declarations: a language-independent approach

Web services fail to deliver on the promise of ubiquitous deployment and seamless interoperability due to the lack of a uniform, standards-based approach to all aspects of security. In particular, the enforcement of access policies in a service oriented architecture is not addressed adequately. We present a novel approach to the distribution and enforcement of credentials-based access policies for Web services (3PAC) which scales well and can be implemented in existing deployments.

/pdf/3pac-enforcing-access-policies-for-web-services-3442027mrt.pdf

3PAC: enforcing access policies for Web services

My thesis is that languages and frameworks can and should be designed to make it easier for programmers to write reviewably secure systems. A system is reviewably secure if its security is easy for an experienced programmer to verify, given access to the source code. A security reviewer should be able, with a reasonable amount of effort, to gain confidence that such a system meets its stated security goals. This dissertation includes work on on language subsetting and web application framework design. 
It presents Joe-E, a subset of the Java programming language designed to enforce object-capability security, simplifying the task of verifying a variety of security properties by enabling sound, local reasoning. Joe-E also enforces determinism-by-default, which permits functionally-pure methods to be identified by their signature. Functional purity is a useful property that can greatly simplify the task of correctly implementing and reasoning about application code. A number of applications of the Joe-E language are presented and evaluated. 
The second part of this dissertation presents tool and framework enhancements for improving the security of web applications. I present techniques for retrofitting existing web applications to use template systems effectively to prevent cross-site scripting and content injection vulnerabilities while preserving functionality. I also show how HTML templates can be rewritten to normalize their output, improving the assurance of security provided by automatic escaping and other static analyses. 
These two applications of my thesis demonstrate that practical enhancements to languages and frameworks can support developers in creating more secure software that is easier to review. Continued improvement in language and framework support for reviewability is a promising approach toward improving the security provided by modern software.

/pdf/language-and-framework-support-for-reviewably-secure-3ivqv9fpls.pdf

Language and framework support for reviewably-secure software systems

http://www.ai.mit.edu/projects/aries/Documents/jhbrown_thesis_proposal.pdf

Memory Management on a Massively Parallel Capability Architecture

The growing role of server systems, especially in the context of the World Wide Web, requires providing flexible and inexpensive mechanisms for accounting for and controlling of resources consumed by individual requests. To a large extent, the Internet server models currently deployed fail in this respect. The focus of this work is to alleviate some problems related to resource management in server environments. In particular, we propose a structured approach to binding threads (execution entities) to resource accounts (abstractions encapsulating rights to using particular amounts of particular resources). The approach advocates separation between protection domains (processes) and resource management; we argue that this is more appropriate for server systems than traditional approaches. Resource accounts address some issues related to trust and to dividing complex requests into separate sub-requests.

Capability-Based Computer Systems

Citations

Frameworks compiled from declarations: a language-independent approach

3PAC: enforcing access policies for Web services

Language and framework support for reviewably-secure software systems

Memory Management on a Massively Parallel Capability Architecture

Internet servers, safe-language extensions, and structured resource control

Related Papers (5)

The protection of information in computer systems

Programming semantics for multiprogrammed computations

EROS: a fast capability system

HYDRA: the kernel of a multiprocessor operating system

Capability-based addressing