Secure and modular access control with aspects

AOSD 2013 - Proceedings of the 2013 ACM on Aspect-Oriented Software Development

Volumn , Issue , 2013, Pages 157-169

  Toledo, Rodolfo ^a   Tanter, Éric ^a  

^a UNIVERSITY OF CHILE   (Chile)

Author keywords

Access control; Aspect oriented programming; Restriction aspects; Scoping strategies

Indexed keywords

ASPECT-ORIENTED; CORE CALCULUS; JAVASCRIPT; MODULARIZED; NON INTERFERENCE; RESTRICTION ASPECTS; SCOPING; SELF PROTECTING;

CALCULATIONS; COMPUTER SYSTEMS PROGRAMMING;

ACCESS CONTROL;

EID: 84876000614     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2451436.2451456     Document Type: Conference Paper

References (36)

1. M. Abadi and C. Fournet. Access control based on execution history. In Proceedings of the 10th annual Network and Distributed System Security Symposium, pages 107-121, 2003.
2. Proceedings of the 9th ACM International Conference on Aspect-Oriented Software Development (AOSD 2010), Rennes and Saint Malo, France, Mar. 2010. ACM Press.
3. M. Bagherzadeh, H. Rajan, G. T. Leavens, and S. Mooney. Translucid contracts: Expressive specification and modular verification for aspect-oriented interfaces. In Proceedings of the 10th ACM International Conference on Aspect-Oriented Software Development (AOSD 2011), Porto de Galinhas, Brazil, Mar. 2011. ACM Press.
4. D. Box and C. Sells. Essential. NET: The common language runtime, volume 1. Addison-Wesley, Nov. 2002.
5. D. Caromel and J. Vayssière. A security framework for reflective Java applications. Software: Practice and Experience, 33(9):821-846, 2003.
6. C. Clifton and G. T. Leavens. MiniMAO1: An imperative core language for studying aspect-oriented reasoning. Science of Computer Programming, 63:312-374, 2006.
7. D. S. Dantas and D. Walker. Harmless advice. In Proceedings of the 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL 2006), pages 383-396, Charleston, South Carolina, USA, Jan. 2006. ACM Press.
8. W. De Borger, B. De Win, B. Lagaisse, and W. Joosen. A permission system for secure AOP. In AOSD 2010 [2], pages 205-216.
9. B. De Win, W. Joosen, and F. Piessens. Developing secure applications through Aspect-Oriented programming. In Aspect-Oriented Software Development, pages 633-650. Addison-Wesley Professional, Oct. 2004.
10. C. Dutchyn, D. B. Tucker, and S. Krishnamurthi. Semantics and scoping of aspects in higher-order languages. Science of Computer Programming, 63(3):207-239, Dec. 2006.
11. ECMA International. ECMAScript Language Specification. ECMA-262. 5th edition, Apr. 2009.
12. U. Erlingsson and F. Schneider. IRM enforcement of Java stack inspection. In Proceedings of the IEEE Symposium on Security and Privacy, pages 246-255, 2000.
13. M. Felleisen, R. B. Findler, and M. Flatt. Semantics Engineering with PLT Redex. MIT Press, 2009.
14. D. Ferraiolo and R. Kuhn. Role-Based access control. 15th NIST-NCSC National Computer Security Conference, pages 554-563, 1992.
15. C. Fournet and A. D. Gordon. Stack inspection: theory and variants. ACM Transactions on Programming Languages and Systems (TOPLAS), 25(3):360 - 399, 2003.
16. J. Gosling, B. Joy, G. Steele, and G. Bracha. The Java Language Specification, 3rd edition. Addison-Wesley, 2005.
17. A. Guha, C. Saftoiu, and S. Krishnamurthi. The essence of JavaScript. In T. D'Hondt, editor, Proceedings of the 24th European Conference on Object-oriented Programming (ECOOP 2010), number 6183 in Lecture Notes in Computer Science, pages 126-150, Maribor, Slovenia, June 2010. Springer-Verlag.
18. N. Hardy. The confused deputy. SIGOPS Operating Systems Review, 22(4):36-38, 1988.
19. M. Huang, C. Wang, and L. Zhang. Toward a reusable and generic security aspect library. In AOSD Technologies for Application-Level Security, 2004.
20. G. Kiczales, E. Hilsdale, J. Hugunin, M. Kersten, J. Palm, and W. Griswold. An overview of AspectJ. In J. L. Knudsen, editor, Proceedings of the 15th European Conference on Object-Oriented Programming (ECOOP 2001), number 2072 in Lecture Notes in Computer Science, pages 327-353, Budapest, Hungary, June 2001. Springer-Verlag.
21. A. Mourad, M. Laverdiãĺre, and M. Debbabi. An aspect-oriented approach for the systematic security hardening of code. Computers & Security, 27(3-4):101-114, June 2008.
22. B. C. d. S. Oliveira, T. Schrijvers, and W. R. Cook. EffectiveAdvice: discplined advice with explicit effects. In AOSD 2010 [2], pages 109-120.
23. R. Ramachandran. AspectJ for Multilevel Security. Master Thesis, Victoria University of Wellington, 2006.
24. P. Samarati and S. D. C. di Vimercati. Access control: Policies, models, and mechanisms. In Foundations of Security Analysis and Design, volume 2171 of Lecture Notes in Computer Science, pages 137-196. Springer Berlin/Heidelberg, London, UK, 2001.
25. P. Slowikowski and K. Zieliński. Comparison study of aspect-oriented and container managed security. In Proceedings of the Workshop on Analysis of Aspect Oriented Software, Germany, 2003.
26. É. Tanter. Expressive scoping of dynamically-deployed aspects. In Proceedings of the 7th ACM International Conference on Aspect-Oriented Software Development (AOSD 2008), pages 168-179, Brussels, Belgium, Apr. 2008. ACM Press.
27. É. Tanter. Beyond static and dynamic scope. In Proceedings of the 5th ACM Dynamic Languages Symposium (DLS 2009), pages 3-14, Orlando, FL, USA, Oct. 2009. ACM Press.
28. É. Tanter. Execution levels for aspect-oriented programming. In AOSD 2010 [2], pages 37-48.
29. É. Tanter, J. Fabry, R. Douence, J. Noyé, and M. Südholt. Scoping strategies for distributed aspects. Science of Computer Programming, 75(12):1235-1261, Dec. 2010.
30. R. Toledo, P. Leger, and É. Tanter. AspectScript: Expressive aspects for the Web. In AOSD 2010 [2], pages 13-24.
31. R. Toledo, A. Núñez, É. Tanter, and J. Noyé. Aspectizing Java access control. IEEE Transactions on Software Engineering, 38(1):101-117, Jan./Feb. 2012.
32. R. Toledo and É. Tanter. Secure and modular access control with aspects-supplementary material. http://users.dcc.uchile.cl/~rtoledo/modac-aosd/.
33. R. Toledo and É. Tanter. Access control in JavaScript. IEEE Software, 28(5):76-84, Sept./Oct. 2011.
34. B. Vanhaute, B. De Decker, and B. De Win. Building frameworks in AspectJ. Workshop on Advanced Separation of Concerns (ECOOP), pages 1-6, 2001.
35. J. Viega, J. Bloch, and P. Chandra. Applying Aspect-Oriented programming to security. Cutter IT Journal, 14(2):31-39, Feb. 2001.
36. A. K. Wright and M. Felleisen. A syntactic approach to type soundness. Journal of Information and Computation, 115(1):38-94, Nov. 1994.