BottleCap

King-Lacroix, Justin; Martin, Andrew

doi:10.1145/2382536.2382545

Cited by 7 publications

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Idea: State-Continuous Transfer of State in Protected-Module Architectures

Strackx

Lambrigts

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The ability to copy data effortlessly poses significant security issues in many applications; It is difficult to safely lend out music or e-books, virtual credits cannot be transferred between peers without contacting a central server or cooperation with other network nodes,. .. Protecting digital copies is hard because of the huge software and hardware trusted computing base applications have to rely on. Protectedmodule architectures (PMAs) provide an interesting alternative by relying only on a minimal set of security primitives. Recently it has been proven that such platforms can provide strong security guarantees. However, transferring state of protected modules has, to the best of our knowledge, not yet been studied. In this paper, we present a protocol to transfer protected modules from one machine to another state-continuously; From a high level point of view, only a single instance of the module exists that executes without interruption when it is transferred from one machine to another. In practice however an attacker may (i) crash the system at any point in time (i.e., a crash attack), (ii) present the system with a stale state (i.e., a rollback attack), or (iii) trick both machines to continue execution of the module (i.e., a forking attack). We also discuss use cases of such a system that go well beyond digital rights management.

show abstract

Idea: State-Continuous Transfer of State in Protected-Module Architectures

Strackx

Lambrigts

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Access right management by extended password capabilities

Lopriore

2017

Int. J. Inf. Secur.

View full text Add to dashboard Cite

With reference to a classic protection system featuring active subjects that reference protected objects, we approach the important problem of identifying the objects that each subject can access, and the operations that the subject can carry out on these objects. Password capabilities are a classical solution to this problem. We propose a new form of password capability, called extended password capability (or e-capability, for short). An e-capability can specify any combination of access rights. A subject that holds a given e-capability can generate new e-capabilities for reduced sets of access rights. Furthermore, a subject that created a given object is in a position to revoke the access permissions granted by every e-capability referencing this object, completely or in part. The size of an e-capability is comparable to that of a traditional password capability. The number of passwords that need to be stored in memory permanently is kept to a minimum, and is equal to a single password for each object.

show abstract

A paradigm for secure object access and unrestricted mobility in distributed systems

Lopriore

2022

International Journal of Parallel, Emergent and Distributed Sys

View full text Add to dashboard Cite

BottleCap

Cited by 7 publications

References 21 publications

Idea: State-Continuous Transfer of State in Protected-Module Architectures

Idea: State-Continuous Transfer of State in Protected-Module Architectures

Access right management by extended password capabilities

A paradigm for secure object access and unrestricted mobility in distributed systems

Contact Info

Product

Resources

About