Skip to main content

2017 | OriginalPaper | Buchkapitel

Capabilities for Java: Secure Access to Resources

verfasst von : Ian J. Hayes, Xi Wu, Larissa A. Meinicke

Erschienen in: Programming Languages and Systems

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

This paper explores adding capabilities to Java with the objective of tightening security management for access to resources both within the Java Class Library and Java applications. Code can only access resources if it is given explicit capabilities, allowing replacement of the use of doPrivileged blocks. Capabilities provide restricted access to their implementing object – like an interface – but when a capability is created, it has a more restrictive dynamic type than its implementing object, and hence access to the full facilities of the implementing object (e.g. via down casting) are precluded. We used the Annotation Processing Tool to track the declaration and use of capabilities.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literatur
2.
Zurück zum Zitat Cifuentes, C., Gross, A., Keynes, N.: Understanding caller-sensitive method vulnerabilities: a class of access control vulnerabilities in the Java platform. In: Proceedings of the 4th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis, SOAP@PLDI 2015, pp. 7–12. ACM (2015) Cifuentes, C., Gross, A., Keynes, N.: Understanding caller-sensitive method vulnerabilities: a class of access control vulnerabilities in the Java platform. In: Proceedings of the 4th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis, SOAP@PLDI 2015, pp. 7–12. ACM (2015)
3.
Zurück zum Zitat Clebsch, S., Drossopoulou, S., Blessing, S., McNeil, A.: Deny capabilities for safe, fast actors. In: Proceedings of the 5th International Workshop on Programming Based on Actors, Agents, and Decentralized Control, AGERE! 2015, pp. 1–12. ACM (2015) Clebsch, S., Drossopoulou, S., Blessing, S., McNeil, A.: Deny capabilities for safe, fast actors. In: Proceedings of the 5th International Workshop on Programming Based on Actors, Agents, and Decentralized Control, AGERE! 2015, pp. 1–12. ACM (2015)
4.
Zurück zum Zitat Gong, L., Ellison, G., Dageforde, M.: Inside Java 2 Platform Security: Architecture, API Design, and Implementation, 2nd edn. Addison Wesley (2003) Gong, L., Ellison, G., Dageforde, M.: Inside Java 2 Platform Security: Architecture, API Design, and Implementation, 2nd edn. Addison Wesley (2003)
7.
Zurück zum Zitat Haller, P., Loiko, A.: LaCaSa: lightweight affinity and object capabilities in scala. In: Proceedings of the ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA 2016, Part of SPLASH 2016, pp. 272–291. ACM (2016) Haller, P., Loiko, A.: LaCaSa: lightweight affinity and object capabilities in scala. In: Proceedings of the ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA 2016, Part of SPLASH 2016, pp. 272–291. ACM (2016)
8.
Zurück zum Zitat Hermann, B., Reif, M., Eichberg, M., Mezini, M.: Getting to know you: towards a capability model for Java. In: Proceedings of the 10th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2015, pp. 758–769. ACM (2015) Hermann, B., Reif, M., Eichberg, M., Mezini, M.: Getting to know you: towards a capability model for Java. In: Proceedings of the 10th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2015, pp. 758–769. ACM (2015)
12.
Zurück zum Zitat Mettler, A., Wagner, D.: The Joe-E language specification, Version 1.0. Technical report EECS-2008-91, University of California, Berkeley, August 2008 Mettler, A., Wagner, D.: The Joe-E language specification, Version 1.0. Technical report EECS-2008-91, University of California, Berkeley, August 2008
13.
Zurück zum Zitat Mettler, A., Wagner, D., Close, T.: Joe-E: a security-oriented subset of Java. In: Proceedings of the Symposium on Network and Distributed System Security, NDSS 2010. The Internet Society (2010) Mettler, A., Wagner, D., Close, T.: Joe-E: a security-oriented subset of Java. In: Proceedings of the Symposium on Network and Distributed System Security, NDSS 2010. The Internet Society (2010)
14.
Zurück zum Zitat Miller, M.S.: Robust composition: towards a unified approach to access control and concurrency control. Ph.D. thesis, Johns Hopkins University (2006) Miller, M.S.: Robust composition: towards a unified approach to access control and concurrency control. Ph.D. thesis, Johns Hopkins University (2006)
16.
Zurück zum Zitat Moore, S., Dimoulas, C., King, D., Chong, S.: SHILL: a secure shell scripting language. In: Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2014, pp. 183–199. USENIX Association (2014) Moore, S., Dimoulas, C., King, D., Chong, S.: SHILL: a secure shell scripting language. In: Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2014, pp. 183–199. USENIX Association (2014)
17.
Metadaten
Titel
Capabilities for Java: Secure Access to Resources
verfasst von
Ian J. Hayes
Xi Wu
Larissa A. Meinicke
Copyright-Jahr
2017
DOI
https://doi.org/10.1007/978-3-319-71237-6_4

Premium Partner