A Family of Securable Protection Systems

This paper describes Metagap e, a formally speciied family of capability systems capable of restricting the transfer of both information and access rights. Previous work indicates that the identiication of such architectures is diicult, and in most cases their veriication is undecidable. To the best of our knowledge, Metagap e spans all real capability systems known to support the connnement property, and excludes all known systems that do not. One test of eeectiveness for a protection system is its ability to enforce the connnement property, which requires that information be contained within well-speciied boundaries. This paper demonstrates a proof of correctness of Metagap e with respect to connnement. We show that the model enforces the connnement requirements if a small number of initial static checks on the connned subsystem are satissed.