The document summarizes Talal A. Alsubaie's 2001 paper on bracket capabilities for distributed systems security. It discusses access control methods like access control lists and capabilities. It then presents a case study of an e-banking system implemented in Java that uses bracket capabilities and role-based access control to restrict access to bank account objects and views based on a user's role (e.g. teller, manager, account owner). Bracket capabilities allow refining the interface exposed to restrict a user's access to only required methods.

1. Talal A. Alsubaie Presenting “Evereds” Paper (2001) Bracket Capability for Distributed Systems Security Talal A. Alsubaie

9. Access Control List (ACL) Talal A. Alsubaie

12. How does ACL Works? Talal A. Alsubaie Create Request ( r ) as Subject ( s ) ( r , s ) Object ACL If ( s appears in ACL) if( r appears in ACL[ s ] ) grant access;

13. Capabilities Talal A. Alsubaie

15. How does Capabilities Works? Talal A. Alsubaie ( r , o ) Object if( r appears in C ) grant access; ( C ) Create Request ( r ) for object ( o ) Pass capability ( C )

18. Banking System Talal A. Alsubaie A Bank Account object

19. Account Object Talal A. Alsubaie Class Accounts { void new (Key newKey, String name); void deposit (Key key, Currency amount); void withdraw (Key key, Currency amount) Currency balance (Key key); String getName (Key key); void setInterest ( Percent rate); void transfer (Key fromKey, Key toKey, Currency amount) }

26. Bracket Capabilities Talal A. Alsubaie

29. Bracket Capabilities Talal A. Alsubaie Capability C Capability Cerf Interface x = c.open(); Capability cref = x.refine(interface, class); Bracketing Object

31. Bracket Capabilities Implementation Talal A. Alsubaie acc = objc.open(); Capability AtmCap = acc.refine(ATMAccounts , Account); Capability objc Capability AtmCap ATMAccount

32. Bracket Capabilities Implementation Talal A. Alsubaie Capability objc Capability AtmCap ATMAccount The result of a further 'refine' operation Capability cerf2 Interface2

33. Talal A. Alsubaie eMail : [email_address] Website : www.talals.net