Non-functional Capability-Based Access Control in the Java Environment
This paper describes a capability-based access control mechanism implemented on a Java environment. In this scheme, access to objects is controlled by means of software capabilities that can be exchanged between mutually suspicious interacting applications. Each application defines the access control rules that must be enforced when interacting with other applications. The definition of access right is managed as a non-functional aspect in the sense it is completely separated from the application code, thus enforcing modularity and ease of expression. It is described in an extended Interface Definition Language (IDL) at the interface level. We have experimented with two prototypes that show how this access control mechanism can be efficiently implemented on a standard Java environment.
KeywordsAccess Control Protection Policy Access Control Policy Access Control Model Method Invocation
Unable to display preview. Download preview PDF.
- 2.J. Chase, H. Levy, M. Feeley, E. Lazowska, Sharing and Protection in a Single-Address-Space Operating System, ACM Transactions on Computer Systems, 12(4), November 1994.Google Scholar
- 3.D. Chess, C. Harrison, A. Kershenbaum, Mobile Agents: Are They a Good Idea?, IBM Research Division, T.J. Watson Research Center, New York, March 1995.Google Scholar
- 5.D. England, Capability, Concept, Mechanism and Structure in System 250, RAIRO-Informatique (AFCET), Vol 9, September 1975.Google Scholar
- 6.J. Gosling and H. McGilton, The Java Language Environment: a White Paper, Sun Microsystems Inc., 1996.Google Scholar
- 7.G. Kiczales, C. Lopes, Aspect-Oriented Programming with AspectJ, Technical Report, Xerox PARC, 1998.Google Scholar
- 8.H. Levy, Capability-Based Computer Systems, Digital Press, 1984.Google Scholar
- 9.M. Shapiro, Structure and Encapsulation in Distributed Systems: The Proxy Principle, 6th International Conference on Distributed Computing Systems, 1986.Google Scholar
- 10.Sun Microsystems, Inc. Enterprise Java Beans Specification, Sun Microsystems, 2000.Google Scholar
- 11.A. Tanenbaum, S. Mullender, R. Van Renesse, Using Sparse Capabilities in a Distributed Operating System, 6th International Conference on Distributed Computing Systems, 1986.Google Scholar
- 12.M. Wilkes, R. Needham, The Cambridge CAP Computer and its Operating System, North Holland, 1979.Google Scholar