Extended discretionary access controls

A discretionary access control mechanism proposed for a secure distributed operating system (DOS) being designed at BBN Laboratories is presented. The DOS is an object-oriented system that uses access control lists to authorize access to objects. Discretionary controls are implemented in a type-specific manner inside the managers of objects. Several extensions to conventional access control lists are proposed, including a limited form of privilege transfer, module interconnection control, support for direct operations roles, and restricted roles. A technique for automatically generating access control implementations is presented that is based on nonprocedural specifications, and an implementation approach is proposed that allows the generated code to be embedded with high assurance in untrusted object managers using hardware protection rings. The concepts and mechanisms are illustrated with a simple banking example.<>