Capability Theory by Sound Bytes
This is a collection of insights for designing capability based systems.
It may have some pertinence to object oriented design.
Here is a short introduction for the non computer specialist.
The Confused Deputy is a paper that describes a complex scenario that convinced me that capabilities were more than merely neat.
Abstraction Mechanisms for Access Control shows how capabilities are largely another perspective on the protection mechanisms found in classic object languages.
Mark Miller gives this Security Taxonomy, and his capabilities based language E.
Read at least the abstract of this paper.
Here are references to a few operating systems that have followed these principles.
Here are some capability ideas conveyed by a real writer, and some introductory essays by Shapiro and a suite of mail lists about capabilities and such.
Alan Bomberger’s truck metaphor.
Capability Myths Demolished (shorter) reports and rectifies several persistent misperceptions of capabilities.
I have not internalized Fred Spiessen’s thesis where he reasons about what programs are in a position to know and act upon concerning security.
Such reasoning is important but left implicit or informal in my pages.
Contrary to this article, we claim that there are computer security solutions.
Here I deplore Apple’s drift toward the walled garden.
Saltzer & Schroeder wrote a comprehensive paper in 1975 on computer security.
Mark Miller’s Thesis organizes and extends many of the ideas described here.
Here are some other perspectives on computer security.
This paper addresses some OS requirements beyond those originally considered in Keykos, but from a capability perspective.
A significant paper on the excessive authority in conventional platforms.
A 2012 survey of recent work.
The Sound Bytes
Notes on Keykos
Rhetorical but important
kinds of capability systems
Two fundamental notions
Objects & Facets
Contrasting authority of programs in different OS Architectures
Confinement and The Factory;
The Factory Patent,
nexus on Covert channels
Fragmentary notes on Durability
Other styles of limiting information flow: Insulation
Don’t show the bits in capabilities.
The Blind Sort
Synergy: Rights Amplification, Sibling Communications, Sealers
Rescinding or Revoking
Capabilities to Resources
Vantage Points for new functionality
Reasoning about the periphery
Principal; On whose behalf?
Early Hardware for Security,
cap oriented hardware;
System Implementation Styles
Recent Complexity Bites,
Vague New Hardware Ideas,
Nexus on capability mapped memory
Ruminations on “Address Space”
fragmentary disk ideas
Security GUI, too,
Nature of Trust
Concept Bridges for Design
The language connection
Blinding Capabilities ala Chaum
Capabilities in disguise
Other Computer Science Issues Related to Capability Designs
Upgrading object behavior
Notes on access control lists (ACL)
Metering Access to Data
Tracking access to data
Fighting over “Capability Based”
Preliminary harping on “Capabilities” for Linux.
Microsoft’s NGSCB (Palladium)
Feeble connection to Physics
quarter baked notes
Accretion of Software Systems
Bug or Feature
Insecurity from anonymous messages
Design Parameters for Capabilities
Variations on Capability notions
Capability like Ideas
General rules for capability systems
The Luring Attack
Monopoly => Complexity?
Unix as Capability System
Note on Tanenbaum’s “Can We Make Operating Systems Reliable and Secure?”
Note on Schneier’s Blog
Some limits to arguing about security
The Application Platform
Violating Rules to Enforce Rules
Web search and Security
Virtualizing other platforms
Hank Levy’s book on capability hardware;
On Virus Filters;
Language references as capabilities;
Cambridge MIPS Hardware;
Carl Ellison’s perspective
His Establishing Identity Without Certification Authorities.
Jed Donnelly’s early (first?) paper on distributed capabilities.
E’s Pluribus protocol
New E stuff:
Mach at Apple, MIT
OsOrg is not about caps, but is a trove of info for kernels.