Application isolation in the Java Virtual Machine

ABSTRACT

To date, systems offering multitasking for the Java™ programming language either use one process or one class loader for each application. Both approaches are unsatisfactory. Using operating system processes is expensive, scales poorly and does not fully exploit the protection features inherent in a safe language. Class loaders replicate application code, obscure the type system, and non-uniformly treat 'trusted' and 'untrusted' classes, which leads to subtle, but nevertheless, potentially harmful forms of undesirable inter-application interaction.In this paper we propose a novel, simple yet powerful solution. The new model improves on existing designs in terms of resource utilization while offering strong isolation among applications. The approach is applicable both on high-end servers and on small devices. The main idea is to maintain only one copy of every class, regardless of how many applications use it. Classes are transparently and automatically modified, so that each application has a separate copy of its static fields. Two prototypes are described and selected performance data is analyzed. Various aspects of the proposed architectural changes to the Java Virtual Machine are discussed.

REFERENCES

• 1: Arnold, J. Shared Libraries on UNIX System V. Summer USENIX Conference, Atlanta, GA, 1986.
• 2: Ken Arnold , James Gosling, The Java programming language (2nd ed.), ACM Press/Addison-Wesley Publishing Co., New York, NY, 1998
• 3: Back, G, Tullmann, P, Stoller, L, Hsieh, W, and Lepreau, J. Java Operating Systems: Design and Implementation. TR UUCS-98-015, Department of Computer Science, University of Utah, August 1998.
• 4: Balfanz, D., and Gong, L. Experience with Secure Multi- Processing in Java. Technical Report 560-97, Department of Computer Science, Princeton University, September, 1997.
• 5: B. N. Bershad , S. Savage , P. Pardyak , E. G. Sirer , M. E. Fiuczynski , D. Becker , C. Chambers , S. Eggers, Extensibility safety and performance in the SPIN operating system, Proceedings of the fifteenth ACM symposium on Operating systems principles, p.267-283, December 03-06, 1995, Copper Mountain, Colorado, United States
• 6: B. N. Bershad , S. Savage , P. Pardyak , D. Becker , M. Fiuczynski , E. G. Sirer, Protection is a software issue, Proceedings of the Fifth Workshop on Hot Topics in Operating Systems (HotOS-V), p.62, May 04-05, 1995
• 7: C. Bryce , J. Vitek, The JavaSeal Mobile Agent Kernel, Proceedings of the First International Symposium on Agent Systems and Applications Third International Symposium on Mobile Agents, p.103, October 03-06, 1999
• 8: Timothy Cramer , Richard Friedman , Terrence Miller , David Seberger , Robert Wilson , Mario Wolczko, Compiling Java Just in Time, IEEE Micro, v.17 n.3, p.36-43, May 1997 [doi>10.1109/40.591653]
• 9: Grzegorz Czajkowski , Thorsten von Eicken, JRes: a resource accounting interface for Java, Proceedings of the 13th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, p.21-35, October 18-22, 1998, Vancouver, British Columbia, Canada
• 10: D. Dillenberger , R. Bordawekar , C. W. Clark, III , D. Durand , D. Emmes , O. Gohda , S. Howard , M. F. Oliver , F. Samuel , R. W. St. John, Building a Java virtual machine for server applications: the Jvm on 0S/390, IBM Systems Journal, v.39 n.1, p.194-210, January 2000
• 11: Bryan Ford , Sai Susarla, CPU inheritance scheduling, Proceedings of the second USENIX symposium on Operating systems design and implementation, p.91-105, October 29-November 01, 1996, Seattle, Washington, United States
• 12: Li Gong, Java Security: Present and Near Future, IEEE Micro, v.17 n.3, p.14-19, May 1997 [doi>10.1109/40.591650]
• 13: Gong, L. and Schemers, R. Implementing Protection Domains in the Java Development Kit 1.2. Internet Society Symposium on Network and Distributed System Security, San Diego, CA, March 1998.
• 14: James Gosling , Bill Joy , Guy Steele , Gilad Bracha, Java Language Specification, Second Edition: The Java Series, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2000
• 15: Gorrie, L. Echidna - a Free Multitask System in Java. http://www.javagroup.org/echidna.
• 16: Hawblitzel, C., Chang, C-C., Czajkowski, G., Hu, D. and von Eicken, T. Implementing Multiple Protection Domains in Java. USENIX Annual Conference, New Orleans, LA, June 1998.
• 17: Sun Microsystems, Inc. JavaBeans. http://java.sun.com/beans/index.html.
• 18: Sun Microsystems, Inc. Java Servlet API. http://java.sun.com/products/servlet.
• 19: Sun Microsystems, Inc. The K Virtual Machine - A White Paper. http://java.sun.com/products/kvm/wp.
• 20: Sheng Liang , Gilad Bracha, Dynamic class loading in the Java virtual machine, Proceedings of the 13th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, p.36-44, October 18-22, 1998, Vancouver, British Columbia, Canada
• 21: Tim Lindholm , Frank Yellin, Java Virtual Machine Specification, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999
• 22: Greg Nelson, Systems programming with Modula-3, Prentice-Hall, Inc., Upper Saddle River, NJ, 1991
• 23: Pugh, W. The Java Memory Model. http://www.cs.umd.edu/~pugh/java/memoryModel.
• 24: William Pugh, Fixing the Java memory model, Proceedings of the ACM 1999 conference on Java Grande, p.89-98, June 12-14, 1999, San Francisco, California, United States [doi>10.1145/304065.304106]
• 25: Saraswat, V. Java is not type-safe. http://www.research.att.com/~vjbug.html.
• 26: David A. Solomon , Helen Custer, Inside Windows NT, Microsoft Press, Redmond, WA, 1998
• 27: Standard Performance Evaluation Corporation. SPEC Java virtual machine benchmark suite. August 1998. http://www.spec.org/osg/jvm98.
• 28: Daniel Spoonhower , Grzegorz Czajkowski , Chris Hawblitzel , Chi Chang , Deyu Hu , Thorsten von Eicken, Design and Evaluation of an Extensible Web & Telephony Server based on the J-Kernel, Cornell University, Ithaca, NY, 1998
• 29: Suri, N., Bradshaw, J., Breedy, M., Groth, P., Hill, G., Jeffers, R., and Mitrovich, T. An Overview of the NOMADS Mobile Agent System. 2 nd International Symposium on Agent Systems and Applications, ASA/MA2000, Zurich, Switzerland, September 2000.
• 30: Robert Wahbe , Steven Lucco , Thomas E. Anderson , Susan L. Graham, Efficient software-based fault isolation, Proceedings of the fourteenth ACM symposium on Operating systems principles, p.203-216, December 05-08, 1993, Asheville, North Carolina, United States
• 31: Dan S. Wallach , Dirk Balfanz , Drew Dean , Edward W. Felten, Extensible security architectures for Java, Proceedings of the sixteenth ACM symposium on Operating systems principles, p.116-128, October 05-08, 1997, Saint Malo, France

INDEX TERMS

Primary Classification:
  D. Software
  D.3 PROGRAMMING LANGUAGES
      D.3.2 Language Classifications

          Nouns: Java

Additional Classification:
  D. Software
  D.3 PROGRAMMING LANGUAGES
      D.3.4 Processors
          Subjects: Optimization
  D.4 OPERATING SYSTEMS
      D.4.1 Process Management
          Subjects: Multiprocessing/multiprogramming/multitasking

General Terms:
Design, Languages, Measurement, Performance, Theory

Keywords:
Java Virtual Machine, application isolation, multitasking