One of the problems with parallel programming is sharing data. A solution to this problem is to enforce restrictions/capabilities upon objects, references or data. This is how the programming langu ...

background

Capability-Based Computer Systems

A Comparison of the Capability Systems of Encore, Pony and Rust

Processes need a variety of resources from their operating environment in order to run properly, but adversary may control the inputs to resource retrieval or the end resource itself, leading to a variety of vulnerabilities. Conventional access control methods are not suitable to prevent such vulnerabilities because they use one set of permissions for all system call invocations. In this paper, we define a novel policy model for describing when resource retrievals are unsafe, so they can be blocked. This model highlights two contributions: (1) the explicit definition of adversary models as adversarial roles, which list the permissions that dictate whether one subject is an adversary of another, and (2) the application of data-flow to determine the adversary control of the names used to retrieve resources. An evaluation using multiple adversary models shows that data-flow is necessary to authorize resource retrieval in over 90% of system calls. By making adversary models and the adversary accessibility of all aspects of resource retrieval explicit, we can block resource access attacks system-wide.

/pdf/policy-models-to-protect-resource-retrieval-2f4zs2vylh.pdf

Policy models to protect resource retrieval

An operating system must manage access rights, which protect the data of one process from interference by other processes, while also permitting appropriate sharing of data. Capability-based addressing achieves this by using protected pointers (q.v.), known as capabilities, to map from the operand field of an instruction to an operand in memory. A capability contains the unique identifier of an object, together with a set of access rights that it possesses to that object (Fig. 1). For example, a capability for an array might contain the array's unique identifier, and a single access right allowing the holder of the capability to read (but not write) the array. Or a capability might identify an employee record within a personnel system, and grant the right to inspect the employee's job title, department, and work location, but not the employee's salary.

Capability-based addressing

: The Security Tagged Architecture Co -Design (STACD) initiative focuses on eliminating inherent software vulnerabilities by redesigning the underlying hardware and the operating system to enforce software security policies and semantics. The new approach will use a metadata processing unit known as the tagged management unit (TMU) that operates concurrently with the CPU to process the metadata. The introduction of tag capable hardware requires software that uses tagged information. We will develop a tag enabled Operating System (OS) that permits the simplification and reduction in size of the OS for easier verification and validation. The STACD project will co-design a new scalable Security Tagged Multicore Processor (STMP), a Security Tagged Zero-Kernel OS (ST - ZKOS), and a Security Tagged Interconnect (STI) that will maintain metadata through execution without negatively influencing performance by processing the data and its corresponding metadata in parallel. This system will enforce software semantics and security policies, guarantee isolation and separation of information, and provide resistance to malicious attacks. The co-design approach provides a higher assurance of compatibility bet ween the components and a stronger security base.

Security Tagged Architecture Co-Design (STACD)

Abstract The deployment of Internet of Things platforms as well as the use of mobile and wireless technologies to support healthcare environments have enormous potential to transform healthcare. This has also led to a desire to make eHealth and mHealth part of national healthcare systems. The COVID-19 pandemic has accelerated the requirement to do this to reduce the number of patients needing to attend hospitals and General Practitioner surgeries. This direction, however, has resulted in a renewed need to look at security of future healthcare platforms including information and data security as well as network and cyber-physical security. There have been security frameworks that were developed to address such issues. However, it is necessary to develop a security framework with a combination of security mechanisms that can be used to provide all the essential security requirements for healthcare systems. In addition, there is now a need to move from frameworks to prototypes which is the focus of this paper. Several security frameworks for eHealth and mHealth are first examined. This leads to a new reference model from which an implementation framework is developed using new mechanisms such as Capabilities, Secure Remote Procedure Calls, and a Service Management Framework. The prototype is then evaluated against practical security requirements. 

/pdf/securing-future-healthcare-environments-in-a-post-covid-19-8kp4maop.pdf

Capability-Based Computer Systems

Citations

A Comparison of the Capability Systems of Encore, Pony and Rust

Policy models to protect resource retrieval

Capability-based addressing

Security Tagged Architecture Co-Design (STACD)

Securing future healthcare environments in a post-COVID-19 world: moving from frameworks to prototypes

Related Papers (5)

The protection of information in computer systems

Programming semantics for multiprogrammed computations

EROS: a fast capability system

HYDRA: the kernel of a multiprocessor operating system

Capability-based addressing