Wed 23 Oct 2024 11:20 - 11:40 at IBR West - Ownership, Security, and Privacy Chair(s): Tobias Wrigstad

Modern software needs fine-grained compartmentalization, i.e., intra-process isolation. A particularly important reason for it are supply-chain attacks, whose danger is aggravated by modern applications depending on hundreds or even thousands of libraries. Object capabilities (ocaps) are a particularly salient approach to compartmentalization, but they require the entire program to assume a lack of ambient authority. Most of existing code was written under no such assumption; effectively, existing applications need to undergo a rewrite-the-world migration to reap the advantages of ocap. We propose gradual compartmentalization, an approach which allows gradually migrating an application to object capabilities, component-by-component in any order, while being able to enforce security policies on any component. The approach relies on runtime authority enforcement and tracking the authority of objects in the type system. We present Gradient, a proof-of-concept gradual compartmentalization extension to Scala which uses Enclosures and Capture Tracking as its key components. We evaluate our proposal by migrating the standard XML library of Scala to Gradient.

Wed 23 Oct

Displayed time zone: Pacific Time (US & Canada) change

10:40 - 12:20
Ownership, Security, and PrivacyOOPSLA 2024 at IBR West
Chair(s): Tobias Wrigstad Uppsala University
10:40
20m
Talk
Law and Order for Typestate with Borrowing
OOPSLA 2024
Hannes Saffrich University of Freiburg, Yuki Nishida Tohoku University, Peter Thiemann University of Freiburg, Germany
DOI
11:00
20m
Talk
Taypsi: Static Enforcement of Privacy Policies for Policy-Agnostic Oblivious Computation
OOPSLA 2024
Qianchuan Ye University at Buffalo, SUNY, Benjamin Delaware Purdue University
DOI
11:20
20m
Talk
Gradient: Gradual Compartmentalization via Object Capabilities Tracked in Types
OOPSLA 2024
Aleksander Boruch-Gruszecki Charles University, Adrien Ghosn Microsoft Research, Mathias Payer EPFL, Clément Pit-Claudel EPFL
DOI
11:40
20m
Talk
Automatically Reducing Privilege for Access Control Policies
OOPSLA 2024
Loris D'Antoni University of Wisconsin-Madison, Shuo Ding Georgia Institute of Technology, Amit Goel AWS, Mathangi Ramesh Amazon Web Services, Neha Rungta Amazon Web Services, Chungha Sung Amazon Web Services, USA
DOI
12:00
20m
Talk
Functional Ownership through Fractional Uniqueness
OOPSLA 2024
Danielle Marshall University of Glasgow; University of Kent, Dominic Orchard University of Kent; University of Cambridge
DOI