Distributed System Security via Logical Frameworks (SeLF)

Abstract

Abstract : We conducted a research program with the goal of advancing security in distributed systems via the application of logical frameworks. Our work targeted multiple facets of the life-cycle of a distributed system, ranging from design through execution, and from sound mechanism design through sound policy enforcement. It consisted of three major interconnected thrusts. First, we investigated how to exploit existing technologies to mechanically reason about security policies as specified in a logical framework. This closed an important security gap, helping users and managers understand the consequences of their policies. Second, we demonstrated the use of logical frameworks for encoding and enforcing access-control policies in a practical distributed system. Access-control mechanisms today, whether it be physical keys for doors or password protection for computer accounts, reflect access-control policies that are explicit only in the manual procedures of the organization that manages these resources. As such, any change in policy, e.g., creating a new computer account, or permitting a person to unlock a door, is effected through a manual process. We utilized logical frameworks to encode organizational policies within computer systems, thereby harnessing the power of these frameworks to support the management and enforcement of access-control policy, and gaining security and flexibility by doing so. We demonstrated this capability in a ubiquitous computing test-bed at Carnegie Mellon. Third, we developed and implemented a framework for the specification of distributed and concurrent systems and their implementations, specifically targeting our test-bad architecture. This work extends a previous collaboration between NRL and Carnegie Mellon that resulted in the design of CLF, an innovative logical language for the specification of concurrent systems. CLF incorporates ideas from logical frameworks, linear logic, and monads into an expressive meta-language.