Data security in an object-oriented environment such as Smalltalk-80

Abstract

Information-flow theory is used to develop a protocol which supports data security in Smalltalk-80. First, the general approach is explained along with its specific issues and problems. This approach establishes a protocol for data flow among objects in the environment. The basic strategy of this protocol is to develop security levels in which objects reside. In these security levels, information can be passed up to an object in an upper or more secure level, but cannot be passed down to an object in a lower of less secure level. This strategy dictates that a security-checking system be developed to control creating objects and passing messages. Solutions to various problems and modifications in the Smalltalk-80 environment are given. These solutions consist of detailed protocols, refined algorithms, and actual Smalltalk code. The main security-verifying algorithm for Smalltalk methods is demonstrated, along with a rigid evaluation of the algorithm and the general security system.<>