ref.bib

@article{lampson1974,
  title={Protection},
  author={Lampson, Butler W},
  journal={ACM SIGOPS Operating Systems Review},
  volume={8},
  number={1},
  pages={18--24},
  year={1974},
  publisher={ACM}
}

@techreport{redell1974,
  title={Naming and protection in extendible operating systems},
  author={Redell, David D},
  year={1974},
  institution={MASSACHUSETTS INST OF TECH CAMBRIDGE PROJECT MAC}
}

@inproceedings{miller2006,
  title={Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control},
  author={Miller, Mark S},
  year={2006}
}
@article{dennis1966,
  title={Programming semantics for multiprogrammed computations},
  author={Dennis, Jack B and Van Horn, Earl C},
  journal={Communications of the ACM},
  volume={9},
  number={3},
  pages={143--155},
  year={1966},
  publisher={ACM}
}
@article{wulf1974,
  title={Hydra: The kernel of a multiprocessor operating system},
  author={Wulf, William and Cohen, Ellis and Corwin, William and Jones, Anita and Levin, Roy and Pierson, Charles and Pollack, Fred},
  journal={Communications of the ACM},
  volume={17},
  number={6},
  pages={337--345},
  year={1974},
  publisher={ACM}
}
@article{wilkes1979,
  title={The Cambridge CAP computer and its operating system},
  author={Wilkes, Maurice Vincent and Needham, Roger Michael},
  year={1979}
}
@article{hardy1985,
  title={KeyKOS architecture},
  author={Hardy, Norman},
  journal={ACM SIGOPS Operating Systems Review},
  volume={19},
  number={4},
  pages={8--25},
  year={1985},
  publisher={ACM}
}

@misc{matte2017,
	title = {Open-{Source} {Clues} to {Google}'s {Mysterious} {Fuchsia} {OS}},
	howpublished = {http://spectrum.ieee.org/tech-talk/computing/software/a-modern-os-from-google},
	abstract = {Google is building a new operating system called Fuchsia, which it hopes can scale from tiny Internet of Things devices to consumer PCs},
	urldate = {2017-05-30},
	author = {Matte, Daniel},
	month = apr,
	year = {2017}
}

@inproceedings{watson2010,
  title={Capsicum: Practical Capabilities for UNIX.},
  author={Watson, Robert NM and Anderson, Jonathan and Laurie, Ben and Kennaway, Kris}
}
@inproceedings{mettler2010,
  title={Joe-E: A Security-Oriented Subset of Java.},
  author={Mettler, Adrian and Wagner, David and Close, Tyler},
  booktitle={NDSS},
  volume={10},
  pages={357--374},
  year={2010}
}
@inproceedings{stiegler2007,
  title={Emily: A high performance language for enabling secure cooperation},
  author={Stiegler, Marc},
  booktitle={Creating, Connecting and Collaborating through Computing, 2007. C5'07. The Fifth International Conference on},
  pages={163--169},
  year={2007},
  organization={IEEE}
}
@inproceedings{bracha2010,
  title={Modules as objects in newspeak},
  author={Bracha, Gilad and Von Der Ah{\'e}, Peter and Bykov, Vassili and Kashai, Yaron and Maddox, William and Miranda, Eliot},
  booktitle={European Conference on Object-Oriented Programming},
  pages={405--428},
  year={2010},
  organization={Springer}
}
@techreport{miller2003,
  title={Capability myths demolished},
  author={Miller, Mark S and Yee, Ka-Ping and Shapiro, Jonathan and others},
  year={2003},
  institution={Technical Report SRL2003-02, Johns Hopkins University Systems Research Laboratory, 2003. http://www. erights. org/elib/capability/duals}
}
@article{miller2008,
  title={Safe active content in sanitized JavaScript},
  author={Miller, Mark S and Samuel, Mike and Laurie, Ben and Awad, Ihab and Stay, Mike},
  journal={Google, Inc., Tech. Rep},
  year={2008},
  publisher={Citeseer}
}
@book{shapiro1999,
  title={EROS: a fast capability system},
  author={Shapiro, Jonathan S and Smith, Jonathan M and Farber, David J},
  volume={33},
  number={5},
  year={1999},
  publisher={ACM}
}
@article{saltzer1975,
  title={The protection of information in computer systems},
  author={Saltzer, Jerome H and Schroeder, Michael D},
  journal={Proceedings of the IEEE},
  volume={63},
  number={9},
  pages={1278--1308},
  year={1975},
  publisher={IEEE}
}
@book{gamma1994,
  author={Gamma, Enrich and Helm, Richard and Johnson, Ralph and Vlissides, John},
  title={Design Patterns, Elements Of Reusable Object-Oriented Software},
  publisher = {Addison Wesley},
  year={1994}
}
@inproceedings{miller2000,
  title={Capability-based financial instruments},
  author={Miller, Mark S and Morningstar, Chip and Frantz, Bill},
  booktitle={International Conference on Financial Cryptography},
  pages={349--378},
  year={2000},
  organization={Springer}
}
@article{morris1973,
  title={Protection in programming languages},
  author={Morris Jr, James H},
  journal={Communications of the ACM},
  volume={16},
  number={1},
  pages={15--21},
  year={1973},
  publisher={ACM}
}
@article{wood2014,
  title={Ethereum: A secure decentralised generalised transaction ledger},
  author={Wood, Gavin},
  journal={Ethereum Project Yellow Paper},
  volume={151},
  year={2014}
}
@inproceedings{miller2003b,
  title={Paradigm regained: Abstraction mechanisms for access control},
  author={Miller, Mark S and Shapiro, Jonathan S},
  booktitle={Annual Asian Computing Science Conference},
  pages={224--242},
  year={2003},
  organization={Springer}
}
@book{murray2010,
  title={Analysing the security properties of object-capability patterns},
  author={Murray, Toby},
  year={2010},
  publisher={Oxford University}
}

@inproceedings{maffeis2010,
  title={Object capabilities and isolation of untrusted web applications},
  author={Maffeis, Sergio and Mitchell, John C and Taly, Ankur},
  booktitle={Security and Privacy (SP), 2010 IEEE Symposium on},
  pages={125--140},
  year={2010},
  organization={IEEE}
}
@inproceedings{devriese2016,
  title={Reasoning about object capabilities with logical relations and effect parametricity},
  author={Devriese, Dominique and Birkedal, Lars and Piessens, Frank},
  booktitle={Security and Privacy (EuroS\&P), 2016 IEEE European Symposium on},
  pages={147--162},
  year={2016},
  organization={IEEE}
}
@inproceedings{dimoulas2014,
  title={Declarative policies for capability control},
  author={Dimoulas, Christos and Moore, Scott and Askarov, Aslan and Chong, Stephen},
  booktitle={Computer Security Foundations Symposium (CSF), 2014 IEEE 27th},
  pages={3--17},
  year={2014},
  organization={IEEE}
}
@article{swasey2017,
  title={Robust and Compositional Verification of Object Capability Patterns},
  author={Swasey, David and Gark, Deepak and Dreyer Derek},
  year={2017},
  howpublished = {https://people.mpi-sws.org/~swasey/papers/ocpl/ocpl-20170418.pdf},
  urldate = {2017-05-30}
}
@inproceedings{spiessens2005,
  title={A practical formal model for safety analysis in capability-based systems},
  author={Spiessens, Fred and Van Roy, Peter},
  booktitle={International Symposium on Trustworthy Global Computing},
  pages={248--278},
  year={2005},
  organization={Springer}
}
@article{spiessens2005b,
  title={SCOLL and SCOLLAR Safe Collaboration based on Partial Trust},
  author={Spiessens, Fred and Jaradin, Yves and Van Roy, Peter},
  year={2005},
  publisher={Citeseer}
}
@inproceedings{drossopoulou2013,
  title={The need for capability policies},
  author={Drossopoulou, Sophia and Noble, James},
  booktitle={Proceedings of the 15th Workshop on Formal Techniques for Java-like Programs},
  pages={6},
  year={2013},
  organization={ACM}
}
@techreport{drossopoulou2014,
  title={Towards Capability Policy Specification and Verification},
  author={Drossopoulou, Sophia and Noble, James},
  year={2014},
  institution={Technical Report ECSTR-14-05, School of Engineering and Computer Science, Victoria University of Wellington}
}
@inproceedings{drossopoulou2014b,
  title={How to break the bank: Semantics of capability policies},
  author={Drossopoulou, Sophia and Noble, James},
  booktitle={International Conference on Integrated Formal Methods},
  pages={18--35},
  year={2014},
  organization={Springer}
}
@inproceedings{drossopoulou2015,
  title={Swapsies on the Internet: First steps towards reasoning about risk and trust in an open world},
  author={Drossopoulou, Sophia and Noble, James and Miller, Mark S},
  booktitle={Proceedings of the 10th ACM Workshop on Programming Languages and Analysis for Security},
  pages={2--15},
  year={2015},
  organization={ACM}
}
@article{drossopoulou2015b,
  title={Reasoning about Risk and Trust in an Open Word},
  author={Drossopoulou, Sophia and Noble, James and Miller, Mark S and Murray, Toby},
  year={2015},
  organization={Technical Report, Victoria University of Wellington}
}
@inproceedings{drossopoulou2016,
  title={Permission and Authority Revisited towards a formalisation},
  author={Drossopoulou, Sophia and Noble, James and Miller, Mark S and Murray, Toby},
  booktitle={Proceedings of the 18th Workshop on Formal Techniques for Java-like Programs},
  pages={10},
  year={2016},
  organization={ACM}
}
@article{hoare1969,
  title={An axiomatic basis for computer programming},
  author={Hoare, Charles Antony Richard},
  journal={Communications of the ACM},
  volume={12},
  number={10},
  pages={576--580},
  year={1969},
  publisher={ACM}
}
@book{huth2004,
  title={Logic in Computer Science: Modelling and reasoning about systems},
  author={Huth, Michael and Ryan, Mark},
  year={2004},
  publisher={Cambridge university press}
}
@inproceedings{clebsch2015,
  title={Deny capabilities for safe, fast actors},
  author={Clebsch, Sylvan and Drossopoulou, Sophia and Blessing, Sebastian and McNeil, Andy},
  booktitle={Proceedings of the 5th International Workshop on Programming Based on Actors, Agents, and Decentralized Control},
  pages={1--12},
  year={2015},
  organization={ACM}
}
@inproceedings{clarke1998,
  title={Ownership types for flexible alias protection},
  author={Clarke, David G and Potter, John M and Noble, James},
  booktitle={ACM SIGPLAN Notices},
  volume={33},
  number={10},
  pages={48--64},
  year={1998},
  organization={ACM}
}