Operating system-style protections for language-based systems

Process-based separation has long been the prevalent model for providing security and isolation to protection domains in computer systems. However, the recent rise of component-based systems, which execute multiple plug-ins in the same process, has exposed a weakness of processes. At the same time, the recent spate of vulnerabilities in software has revealed the usefulness of language-based schemes to supplement the protections offered by processes. I propose a language-based protection model to replace processes as the basis for providing security and isolation. In this thesis, I present three different language-based mechanisms which add particular operating system-style protection semantics to the language. Soft termination provides a mechanism for guaranteed, safe termination of a task without interfering with other modules. Garbage collector memory accounting provides an accurate accounting of the memory used by each individual task running in the language-based system. Soft boundaries is a set of static analyses to verify that a specified task separation policy is followed by a particular codebase. These mechanisms provide the security and isolation that process-based separation provides, while tackling the problems of component-based architectures and malicious code head-on.

Name thesis:degree_name

Doctor of Philosophy

Level thesis:degree_level

Doctoral

Discipline thesis:degree_discipline

Engineering

Grantor

Rice University

Year dc:date.issued

2007

Author dc:creator

• Rudys, Algis

Advisor dc:contributor.advisor

• Wallach, Dan S.

• Computer science

Statement dc:rights

• Copyright is held by the author, unless otherwise indicated. Permission to reuse, publish, or reproduce the work beyond the bounds of fair use or other exemptions to copyright law must be obtained from the copyright holder.

Language dc:language.iso

eng

Handle dc:identifier.uri

https://hdl.handle.net/1911/20640

OAI identifier oai:identifier

oai:repository.rice.edu:1911/20640