Capability Confinement by Membranes

In capability systems it can be hard to assert confinement from static analysis only. In this paper we propose membranes as an extension for capability secure languages to help ensure confinement at runtime. We apply the extension to a subset of the multi-paradigm language Oz and provide the operational semantics of the extended language. 1 Problem context Secure systems aim at providing privacy of information and confinement of services. Systems based on Access Control Lists (ACLs) rely on a special module called the ”reference monitor”, to force an access-control policy. Designation of a resource doesn’t imply access to that resource. Systems based on Capabilities [MSC + 01] have no reference monitor: designation is equivalent to access. The language runtime ensures that references are unforgeable. References to resources and services are called capabilities. A process X that has access to a service C can transfer tha