Please use this identifier to cite or link to this item:
https://hdl.handle.net/2440/86863
Type: | Thesis |
Title: | Software-based reference protection for component isolation. |
Author: | Yarom, Yuval |
Issue Date: | 2014 |
School/Discipline: | School of Computer Science |
Abstract: | Reference protection mechanisms are commonly used to isolate and to provide protection for components that execute within a shared run-time environment. These mechanisms often incur an overhead due to maintaining the isolation or introduce inefficiencies in the communication between the components. Past research operated under the assumption that some performance loss is an acceptable price for the added security that comes with better isolation. This thesis sets out to demonstrate that good isolation does not imply performance loss. While numerous models for implementing reference protection have been suggested, there is a lack of a unified terminology that allows the comparison of systems from across the domain. This thesis presents a classification framework that captures the trade-offs present in the design of reference protection. It identifies four main models of reference protection: complete isolation, where components do not share references to objects; object sharing, where components can share data while still maintaining private, unshared data; partial isolation, where components have private, unshared data and an exposed interface that allows other component's indirect access to the private data; and initial isolation, where components are isolated when created, but the model allows the programmer to share references without restriction. Applying the classification to systems providing reference protection identifies a gap in the prior research. Partial isolation promises the level of security expected from component isolation combined with efficient communication. Yet, the only implementation of partial isolation of components uses expensive run-time checks to enforce the protection. To bridge this gap, this thesis presents the Exported Types design. Exported Types is a type system design that enforces partial isolation at compile time. Using compile-time checks removes the run-time overhead of enforcing the protection model. The design is applied to a meta-circular Java virtual machine to isolate the virtual machine code from the application. Applying reference protection in this scenario reduces the number of classes the virtual machine exposes to the application by two orders of magnitude. Performance tests demonstrate that reference protection, and the higher security it provides, are achieved at no performance cost. |
Advisor: | Munro, David S. Falkner, Katrina Elizabeth |
Dissertation Note: | Thesis (Ph.D.) -- University of Adelaide, School of Computer Science, 2014 |
Keywords: | type system; reference protection; isolation; managed runtimes |
Provenance: | This electronic version is made publicly available by the University of Adelaide in accordance with its open access policy for student theses. Copyright in this thesis remains with the author. This thesis may incorporate third party material which has been used by the author pursuant to Fair Dealing exceptions. If you are the owner of any included third party copyright material you wish to be removed from this electronic version, please complete the take down form located at: http://www.adelaide.edu.au/legals |
Appears in Collections: | Research Theses |
Files in This Item:
File | Description | Size | Format | |
---|---|---|---|---|
01front.pdf | 262.8 kB | Adobe PDF | View/Open | |
02whole.pdf | 961.73 kB | Adobe PDF | View/Open | |
Permissions Restricted Access | Library staff access only | 176.56 kB | Adobe PDF | View/Open |
Restricted Restricted Access | Library staff access only | 961.48 kB | Adobe PDF | View/Open |
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.