Secure Abstraction with Code Capabilities
Robbert van Renesse, Håvard D. Johansen, Nihar Naigaonkar, Dag Johansen · 2013
We propose embedding executable code fragments in cryptographically protected capabilities to enable flexible discretionary access control in cloud-like computing infrastructures. We demonstrate how such a code capability mechanism can be implemented completely in user space. Using a novel combination of X.509 certificates and JavaScript code, code capabilities support restricted delegation, confinement, revocation, and rights amplification for secure abstraction.