Paradigm Regained: Abstraction Mechanisms for Access Control

Abstract. Access control systems must be evaluated in part on how well they support the Principle of Least Authority (POLA), i.e., how well they enable the distribution of appropriate access rights needed for cooperation, while simultaneously limiting the inappropriate proliferation of access rights which would create vulnerabilities. POLA may be practiced by arrangement of permissions and by abstraction of access. To date, access control systems have been evaluated only by their effectiveness at POLA-by-arrangement. Working in the original capability model proposed by Dennis and van Horn, we show how actual systems have used abstraction to enforce revocation, confinement, and the *-properties—policies whose enforcement has been “proven ” impossible by arrangement-only analysis. To account for these abilities, analysis must also examine the behavior of security-enforcing programs (which are usually simple) to see how they limit the authority of arbitrarily complex untrusted programs. The original capability model, analyzed in these terms, is shown to be stronger than is commonly supposed