Abstract
Program monitoring is a well-established and efficient approach to security policy enforcement. An implementation of program monitoring that is particularly appealing for application-level policy enforcement is monitor inlining: the application is rewritten to push monitoring and policy enforcement code into the application itself. The intention is that the inserted code enforces compliance with the policy (security), and otherwise interferes with the application as little as possible (conservativity and transparency).
For sequential Java-like languages, provably correct inlining algorithms have been proposed, but for the multithreaded setting, this is still an open problem. We show that no inliner for multithreaded Java can be both secure and transparent. It is however possible to identify a broad class of policies for which all three correctness criteria can be obtained. We propose an inliner that is correct for such policies, implement it for Java, and show that it is practical by reporting on some benchmarks.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Evans, D., Twyman, A.: Flexible policy-directed code safety. In: IEEE Symposium on Security and Privacy, pp. 32–45 (1999)
Erlingsson, Ú., Schneider, F.B.: SASI enforcement of security policies: a retrospective. In: Proc. Workshop on New Security Paradigms (NSPW 1999), pp. 87–95. ACM Press, New York (2000)
Schneider, F.B.: Enforceable security policies. ACM Trans. Information and System Security 3(1), 30–50 (2000)
Hamlen, K.W., Morrisett, G., Schneider, F.B.: Computability classes for enforcement mechanisms. ACM Trans. Program. Lang. Syst. 28(1), 175–205 (2006)
Erlingsson, Ú.: The inlined reference monitor approach to security policy enforcement. Ph.D thesis, Dept. of Computer Science, Cornell University (2004)
Bauer, L., Ligatti, J., Walker, D.: Composing security policies with polymer. In: PLDI, pp. 305–314 (2005)
Hamlen, K.W., Morrisett, G., Schneider, F.B.: Certified in-lined reference monitoring on .NET. In: PLAS, pp. 7–16 (2006)
Erlingsson, Ú., Schneider, F.B.: IRM enforcement of Java stack inspection. In: IEEE Symposium on Security and Privacy, pp. 246–255 (2000)
Aktug, I., Dam, M., Gurov, D.: Provably correct runtime monitoring. In: Cuellar, J., Maibaum, T., Sere, K. (eds.) FM 2008. LNCS, vol. 5014, pp. 262–277. Springer, Heidelberg (2008)
Vanoverberghe, D., Piessens, F.: A caller-side inline reference monitor for an object-oriented intermediate language. In: Barthe, G., de Boer, F.S. (eds.) FMOODS 2008. LNCS, vol. 5051, pp. 240–258. Springer, Heidelberg (2008)
Chen, F., Rosu, G.: Java-MOP: A monitoring oriented programming environment for Java. In: Halbwachs, N., Zuck, L.D. (eds.) TACAS 2005, vol. 3440, pp. 546–550. Springer, Heidelberg (2005)
Hamlen, K.W., Jones, M.: Aspect-oriented in-lined reference monitors. In: PLAS, pp. 11–20 (2008)
Dam, M., Jacobs, B., Lundblad, A., Piessens, F.: Provably correct inline monitoring for multithreaded Java-like programs. Journal of Computer Security (2009)
Ligatti, J., Bauer, L., Walker, D.: Edit automata: enforcement mechanisms for run-time security policies. Int. J. Inf. Sec. 4(1-2), 2–16 (2005)
Ligatti, J.A.: Policy Enforcement via Program Monitoring. Ph.D thesis, Princeton University (2006)
Viswanathan, M.: Foundations for the run-time analysis of software systems. Ph.D thesis, University of Pennsylvania (2000)
Verhanneman, T., Piessens, F., De Win, B., Joosen, W.: Uniform application-level access control enforcement of orginzationwide policies. In: Twenty-First Annual Computer Security Applications Conference, pp. 389–398 (2005)
Dantas, D.S., Walker, D.: Harmless advice. In: POPL, pp. 383–396 (2006)
Shah, V., Hill, F.: An aspect-oriented security framework. In: Proceedings of the DARPA Information Survivability Conference, pp. 143–145 (2004)
Gosling, J., Joy, B., Steele, G., Bracha, G.: Java Language Specification, 3rd edn. Prentice Hall, Englewood Cliffs (2005)
Jeffrey, A., Rathke, J.: Java Jr: Fully abstract trace semantics for a core Java language. In: ESOP, pp. 423–438 (2005)
Jeffrey, A., Rathke, J.: A fully abstract may testing semantics for concurrent objects. Theor. Comput. Sci. 338(1-3), 17–63 (2005)
Aktug, I., Naliuka, K.: ConSpec – a formal language for policy specification. Electron. Notes Theor. Comput. Sci. 197(1), 45–58 (2008)
Lindholm, T., Yellin, F.: Java Virtual Machine Specification. Addison-Wesley Longman Publishing Co., Inc., Boston (1999)
ObjectWeb: Asm - home page (February 2008)
Freund, S.N., Mitchell, J.C.: A type system for object initialization in the Java bytecode language. ACM Trans. Program. Lang. Syst. 21(6), 1196–1250 (1999)
Leroy, X.: Java bytecode verification: Algorithms and formalizations. J. Autom. Reasoning 30(3-4), 235–269 (2003)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Dam, M., Jacobs, B., Lundblad, A., Piessens, F. (2009). Security Monitor Inlining for Multithreaded Java. In: Drossopoulou, S. (eds) ECOOP 2009 – Object-Oriented Programming. ECOOP 2009. Lecture Notes in Computer Science, vol 5653. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-03013-0_25
Download citation
DOI: https://doi.org/10.1007/978-3-642-03013-0_25
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-03012-3
Online ISBN: 978-3-642-03013-0
eBook Packages: Computer ScienceComputer Science (R0)