A Note on the Confinement Problem.¶
Lampson, B. W. (1973). A Note on the Confinement Problem. Communications of the ACM, 16(10), 613-615.
Cited by¶
4 citations across 4 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Confidentiality
- Confidentiality therefore binds use after access, the single sentence from which every other property of the prime follows.
This sourcePoses the problem of constraining what a program legitimately given data may afterwards do with it, and enumerates the open-ended set of leakage channels that makes the transmission surface impossible to inventory.
Supported in partVerified against the work's full text
Lampson frames the confinement problem as leakage after access is properly granted, which supports binding use after access; the "single sentence" claim is not his.
“Even when all unauthorized access has been pre- vented, there remain two ways in which the customer may be injured by the service”
- Confidentiality therefore binds use after access, the single sentence from which every other property of the prime follows.
- Escape and Leakage
- The pattern encodes that containment is never perfect; boundaries always have seams and pathways available for escape, and whether escape occurs depends on the pressure differential, the permeability of alternative pathways, and whether those pathways are explicitly designed or merely overlooked—a claim Lampson (1973) made canonical in his foundational analysis of the confinement problem.
This sourceCanonical computer-security analysis of how a confined program leaks information through legitimate, storage, and covert channels; establishes that no boundary is perfectly impermeable and supplies the pathway taxonomy underlying containment design.
Supported in partVerified against the work's full text
Lampson shows a confined program can leak through storage, legitimate and covert channels that are hard to enumerate, but gives no pressure-differential or designed-versus-overlooked account.
“There is not likely to be any rigorous way of identifying every channel in any system of even moderate”
- The pattern encodes that containment is never perfect; boundaries always have seams and pathways available for escape, and whether escape occurs depends on the pressure differential, the permeability of alternative pathways, and whether those pathways are explicitly designed or merely overlooked—a claim Lampson (1973) made canonical in his foundational analysis of the confinement problem.
- Markov Blanket
- The identical logic governs a cell membrane (all matter and signal exchange passes through receptors and transporters; a toxin exploiting an unguarded channel is a side-channel) and a need-to-know intelligence compartment (the cleared liaison is the blanket; an unauthorized back-channel is the leak).
This sourceCoins and defines covert channels — paths not intended for information transfer — the canonical reference for side/covert-channel leakage as a failure of a constructed boundary (need-to-know compartment).
- The identical logic governs a cell membrane (all matter and signal exchange passes through receptors and transporters; a toxin exploiting an unguarded channel is a side-channel) and a need-to-know intelligence compartment (the cleared liaison is the blanket; an unauthorized back-channel is the leak).
Mechanisms¶
- Sandboxed Candidate Execution
- A sandbox bounds overt behavior but not necessarily covert channels — timing, cache, or resource side-channels can leak or signal without tripping the policy,
This sourceShows that confining overt program outputs does not eliminate covert channels through shared resources or timing.
- A sandbox bounds overt behavior but not necessarily covert channels — timing, cache, or resource side-channels can leak or signal without tripping the policy,
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 2 of 4 citations: 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:f6a23916be00 · see in the full table