An Environment for Developing Securely Interoperable Heterogeneous Distributed Objects

PROJECT DESCRIPTION The heterogeneity a n d v olatility of open distributed systems make high assurance security a n elusive goal. One solution is to provide developers with tools for designing and implementing robust object systems with veriiable behavior in open environments (Cleaveland et al., 1 9 9 4). The Meta-Object Operating System Environment (MOOSE) (Hale et al., 1997) is intended to support the development, execution and veriication of secure heterogeneous distributed systems. MOOSE uses a layered architecture (see, e.g., Zhang et al., 1995) and dual operational and ver-iication frameworks to blend object technology with formal methods (Figure 1). The foundation of MOOSE is provided by the Robust Object Calculus (ROC), a process calculus (see, e.g., Milner et al., 19899 Nierstrasz, 1991) for modeling and reasoning about distributed objects. The Meta-Object Model (MOM), deened using ROC, forms the next layer of the operational framework. It is a primitive distributed object architecture (see, e.g., Agha, 19866 Houck and Agha, 1992) for constructing more sophisticated object models and programming languages that constitute the upper levels of the operational framework. MOM implements a capability-based security m o d e l