RINA and capabilities

I've just come across the idea of the Recursive Internetwork Architecture
and thought it had a number of properties that might interest capability
folk, if only for an idea to riff off of.

To quote from here: http://irati.eu/the-recursive-internetwork-architecture/

"The principles behind RINA, were first presented by John Day in his book
“Patterns in Network Architecture: A return to Fundamentals”. This work is
a start afresh, taking into account lessons learned in the 35 years of
TCP/IP’s existence, as well as the lessons of OSI’s failure and the lessons
of other network technologies of the past few decades, such as CYCLADES,
DECNET or XNS.
RINA takes as a point of departure the basic premise that “networking is
inter-process communication (IPC) and only IPC”. Networking provides the
means by which processes on separate computer systems communicate,
generalizing the model of local inter-process communications. In an
operating system, to allow two processes to communicate, IPC requires
certain functions such as locating processes, determining permissions,
passing information, allocating resources and managing memory. We may call
this part of the Operating System dedicated to provide IPC Services an IPC
Facility. Similarly, two application processes residing on different
systems communicate and share state information by utilizing the services
of a Distributed IPC Facility (DIF). Figure 1 shows different examples of
application processes A and B communicating i) within a single system, ii)
between two directly connected systems and iii) between two systems
connected by an intermediate system dedicated to doing IPC (i.e. a router).
Each scenario requires one or more DIFs, each one optimized for providing
IPC services over a certain scope (local, single link, network). Networking
can be defined as a distributed application dedicated to provide IPC
services to other applications."

I find it a very nice model. It almost like objectifying the network. The
red light from from a capability based point of view  is "determining
permissions". Now the security model isn't set, apart from some form of
authentication when joining a DIF. Is there an even nicer model that uses
capabilities to avoid confused deputy and other such issues? And is anyone
working on it?

  Will Pearson

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk