Improving the Security, Scalability, Manageability and Performance of System Services for Network Computing
|
|
- Bartholomew Dale Bradley
- 8 years ago
- Views:
Transcription
1 Improving the Security, Scalability, Manageability and Performance of System Services for Network Computing Emin Gün Sirer, Robert Grimm, Arthur J. Gregory, Nathan Anderson, Brian N. Bershad Dept. of Computer Science & Engineering University of Washington Seattle, WA Introduction Abstract Modern virtual machines, such as Java and Inferno, are emerging as network computing platforms. While these virtual machines provide higher-level abstractions and more sophisticated services than their predecessors from twenty years ago, their architecture has essentially remained unchanged. State of the art virtual machines are still monolithic, that is, they are comprised of closely-coupled service components, which are thus replicated over all computers in an organization. This crude replication of services forms one of the weakest points in today s networked systems, as it creates widely acknowledged and well-publicized problems of security, manageability and performance. We have designed and implemented a new system architecture for network computing based on distributed virtual machines. In our system, virtual machine services that perform rule checking and code transformation are factored out of clients and are located in enterprisewide network servers. The services operate by intercepting application code and modifying it on the fly to provide additional service functionality. This architecture reduces client resource demands and the size of the trusted computing base, establishes physical isolation between virtual machine services and creates a single point of administration. We demonstrate that such a distributed virtual machine architecture can provide substantially better integrity and manageability than a monolithic architecture, scales well with increasing numbers of clients, and does not entail high overhead. Virtual machines (VMs) have evolved significantly in the last two decades and may soon serve as a widely available network computing platform [Lindholm&Yellin96, Inferno, Adl-Tabatabai et al. 96]. They are particularly well suited for network computing because they offer a uniform programming model, work on a wide range of systems, and provide a variety of high-level services not supported by native architectures and general purpose operating systems. Modern virtual machines offer services, such as dynamic extensibility, verification, just-in-time compilation, configurable security policies and garbage collection, which are much more sophisticated compared to their predecessors [IBMVM86] and not readily found in general purpose operating systems [Custer 93]. In addition to the growth in the complexity of virtual machine services, the scale of deployment for VM systems has changed as well. Unlike early virtual machine systems that were typically confined to a few dedicated mainframes per enterprise, modern virtual machines are deployed in organizations with hundreds or thousands of heterogeneous hosts. Active content is now pervasive on the Internet, where about 1% of the roughly 125 million pages indexed by AltaVista reference a Java applet. More than 90% of the approximately 120 million deployed web browsers contain the Java virtual machine, and transparently fetch and execute active content from the world wide web. Even though virtual machine services have become much more numerous and complex, and even though the scale of deployment for VM systems has changed drastically, the service architecture of virtual machines has remained unchanged over the last few decades. Today s virtual machines still rely on a monolithic architecture in which all service components reside locally on the host intended to run the applications. Consequently, service implementations and service state are replicated across all virtual machines in an organization.
2 As a result of this crude placement and replication of functionality, modern virtual machines suffer from security problems [Dean et al. 97], are difficult to manage, and impose high resource requirements [Madany 96]. Furthermore, colocation of VM services has resulted in non-modular systems that exhibit complex inter-component interactions, as observed [Accetta et al. 89, Bershad et al. 95, Engler et al. 95] for other monolithic systems. In particular, networks of monolithic virtual machines exhibit the following shortcomings: The lack of separation between virtual machine components means that a flaw in a single component of the virtual machine places the entire machine at risk. Furthermore, since policy specification and security enforcement are performed on the same host that runs potentially untrusted applications, one-time security holes can lead to long-term security compromises [Thompson 84]. Since each virtual machine is a completely independent entity, there is no central point of control in an enterprise. There are no transparent and comprehensive techniques for distributing security upgrades, capturing audit trails, and pruning a network of rogue applications. Virtual machine services, such as just-in-time compilation and verification, have substantial processing and memory requirements. When performed on the client, they can reduce overall application performance. Monolithic systems are not suitable for hosts, such as embedded devices, which lack the resources to support a complete virtual machine. In the rest of this paper, we describe a virtual machine architecture based on distributed service components that addresses these problems. Our architecture is founded on factoring virtual machine services into logical components and placing these services at appropriate locations in the network. We have designed and implemented a Java virtual machine based on this architecture. Our VM includes a Java runtime, a verifier, a security service, a generic binary rewriting service and a compiler. It differs from existing systems in that these services are factored into well-defined components and centralized where necessary. The rest of the paper is structured as follows. Section 2 explains our approach and the goals of our architecture. Section 3 provides an overview of our system, and Section 4 describes the individual services in detail. Section 5 presents an evaluation of the architecture. Section 6 discusses related work, and Section 7 concludes. 2. Approach and Goals Our approach to the problems posed by monolithic virtual machines is based on service decomposition and distribution. We identify the logical services in existing VMs, factor them into separate modules with well defined interfaces, and place related services at locations in the network that suit their function [Figure 1]. We identify three major categories for related services. First, the runtime provides fundamental virtual machine functionality such as interpreting bytecodes and implementing core libraries. Second, rule checking ensures that the code executed by the runtime respects a set of requisite constraints, such as typesafety and access limits. Third, code transformation changes the code to be executed, for example by translating it into a native representation, or by modifying its runtime behavior. Platform Services JIT Compiler Bytecode Interpreter Verifier Security Checker Garbage Collector Runtime Library Code Transformation Service Runtime Rule Checker Figure 1. Monolithic versus factored virtual machines. The diagram on the left illustrates the current state of the art for modern virtual machines. Services in a monolithic VM are often indiscernible and not isolated from each other. The diagram on the right illustrates our approach. We factor the virtual machine into three major service groups; namely, rule checking, code transformation and runtime services. 2
3 Factoring a monolithic VM into individual services enables a modular service infrastructure, with clear component boundaries and explicit interaction. Modularization thus helps define the trusted computing base, enables the piecewise testing of components, simplifies auditing, and thereby can produce systems of high assurance. It also enables us to migrate functionality out of clients into locations more suitable to their function. This flexibility in service placement reduces the size of the trusted computing base, decreases resource requirements in clients, and physically isolates services from each other. Service granularity and placement are determined by the security, manageability, performance and scalability requirements of the overall system. For general-purpose network computing, which forms the application domain of our architecture, these requirements can be summarized as follows: Security: The trusted computing base should be well defined, small, and physically isolated from application code [Saltzer&Schroeder 75]. An organization should have the ability to make network-wide, mandatory access control decisions, and know that they are being enforced on all clients. Manageability: Management of virtual machines should be uniform across platforms and there should be a central point of control for administration. Performance: Services should place a minimal processing burden on client machines and not require a large investment in the service infrastructure. Scalability: Virtual machine implementations should scale over the diverse architectures and platforms found in a typical network. The minimum memory and processing requirements of a virtual machine should be small, though the system should be able to utilize all available resources when necessary. In addition to these goals, a viable architecture should be backward compatible with the large base of currently deployed monolithic virtual machines. Its implementation should preserve the external representations of existing virtual machines [Lindholm&Yellin96], as well as their platform APIs [Gosling&Yellin 96. This approach enables an upgrade path from existing monolithic virtual machines to a distributed service architecture. 3. Architecture Overview The central tenet of our architecture is to break up monolithic virtual machines into logical services, each of which performs a single function. The result of applying this principle on a modern virtual machine is illustrated in Figure 2. The services that perform rule checking and code transformation are separated from each other as well as from the runtime. This separation between components makes it possible to place services on hosts that suit their function. In particular, we centralize all functionality that is not inherently part of the client runtime. The resulting service infrastructure is uniform across different platforms and provides a central point of control within an organization. Code Transformation Services Rule Checker Compiler Rewriter Platform Services Security Enforcer Verifier Runtime Library Bytecode Interpreter Runtime Garbage Collector Figure 2. The static service decomposition of the Java virtual machine. Centralized services in our architecture share the same basic structure. A static component performs most of the overall service functionality before an application is actually executed. Fundamentally, static components inspect incoming code and, if necessary, modify it to reflect required service characteristics. They may also inject dynamic service operations which are then executed by a small component on the client. For example, our verifier performs all code inspection, including data-flow and dependency analysis, in the static component. It defers cross-module 3
4 checks that can not be resolved to execution time. This flow of code through the service infrastructure to the client runtime is illustrated in Figure 3. The static service components generate a set of desired properties, and feed both the code and the properties to the code transformation services. After transformation, the modified code reflects an organization s policies and is thus self-managing during execution. A generic binary rewriter and a compiler provide code transformation services. The rewriter instruments binaries with service-specific code snippets. It is structured around an event-based model. Events are associated with code abstractions, such as methods, basic blocks and individual instructions. The rewriter invokes registered eventhandlers for each of the constructs it encounters in the code. An event handler may then add, change or delete instruction sequences in order to provide service functionality. The use of an event-based interface reduces system latency as it enables rewriting to be performed Code Properties concurrently with the fetching and forwarding of application code. The client runtime executes the managed code produced by the code transformation services. It relies on digital signatures to verify that incoming code has been vetted by the requisite services. The runtime can redirect incorrectly signed or unsigned code to the centralized services [Spyglass 94]. Since the runtime is shielded by the centralized services, it may implement richer interfaces than those available publicly. As these interfaces may be unsafe, the verifier ensures that incoming code does not reference them. For example, our runtime provides a call to explicitly free a given object. A service for reducing garbage collection overhead may then perform liveness analysis on incoming code and insert explicit calls to free unreachable objects. Figure 3. Code flow in our system architecture. Our service architecture differs from the state of the art in two fundamental ways. First, the centralized services are mandatory for all clients in an organization. For example, security checks injected into incoming code are inseparable from applications at the time of their execution. They are thus binding throughout the network. Second, there is a single point of control for all virtual machines within an organization. For example, the security policy is specified and controlled at a single location. In addition, use of binary rewriting preserves compatibility with existing monolithic virtual machines. It thus provides a gradual conversion path to distributed virtual machines. A monolithic virtual machine may subject the rewritten code to redundant checks or services, but it also benefits from the added functionality. 4. Services We have built a Java virtual machine using our distributed service architecture. Decomposing the services found in a modern Java VM, and distributing them within a network while retaining and improving their functionality posed a number of challenges. In the sections below, we discuss each of the services in detail, and report on our experience with their design and implementation using our architecture Verification Java s appeal for network computing stems principally from its strong safety guarantees. A comprehensive set of safety constraints allows the VM to integrate potentially malicious code into a privileged base system [Stata&Abadi 98, Freund&Mitchell 98]. The enforcement of these type and system safety constraints is performed by the Java verifier. A Java verifier needs to check four different classes of constraints. The first set of safety axioms ensures that the class file is well formed. For instance, indices and offset references that appear in various constructs in the class file must be within particular bounds to be valid. The second set of safety constraints makes sure that the code within a class is well structured. For example, all instructions must contain valid operands, methods must properly return control on all execution paths and control flow instructions should not branch into the middle of an instruction. The most complex part of verification involves the third set of safety axioms related to typesafety. To ensure that code is VM Code Transformation Services Managed Code VM Native Runtime Clients 4
5 typesafe, the verifier relies on type-inference and data flow analysis to make sure that no path of execution can result in a type error at runtime. Finally, a fourth set of safety axioms ensures that assumptions made in one class about the public interfaces of other classes are consistent with their implementation. Whereas the first three sets of constraints apply to a single class in isolation, the fourth set applies to the composition of classes. Commercial verifiers found in monolithic virtual machines have had difficulty in imposing these constraints. First, since the Java specification is not formal in its description of the safety axioms, there are differences between verifier implementations. Verifiers from Sun and Microsoft disagree on underspecified issues such as constraints on uninitialized objects, subroutine calls, and cross-validation of redundant data in a class file. Furthermore, in response to discoveries of security flaws, monolithic VM vendors have difficulty propagating security patches to all of their clients in a timely manner. Finally, the data-flow analysis stage of verification is memory and processing intensive, and renders monolithic systems unsuitable for resource limited systems such as smart cards. To address these shortcomings, we centralize the bulk of the verification service in accordance with our architecture. In our implementation, the first three phases of verification are performed statically in a network server. The static verifier component examines each class as it is fetched, and checks to make sure that it is safe in isolation. The fourth phase of verification requires access to dynamic client state describing the composition of classes in different namespaces. While it is possible to track and mirror this state in a network server, or to devise a protocol for querying client state remotely from the server, both techniques require modifications to existing clients. In order to remain compatible with existing virtual machines, we defer the link phase checks to a small client component. During the processing of the first three phases, the verification service collects all of the assumptions that a class makes about its environment and computes the scope of these assumptions. For example, fundamental assumptions, such as inheritance relationships, affect the validity of the entire class, whereas a field reference affects only the instructions that rely on the reference. Having determined the assumptions and their scope, the verification service modifies the code to perform the checks at runtime by invoking a simple service component [Figure 4]. Since most safety axioms have been resolved by this time, the functionality in the dynamic component is limited to a descriptor lookup and string comparison. The dynamic component itself resides on a central server and is provided to clients on demand. This lazy scheme for deferring link phase checks as late as possible has the property that the classes which make up a component are not fetched from a remote, and potentially slow, server unless they are needed for execution. FODVV+HOOR^ VWDWLFERROHDQBBPDLQ&KHFNHG,QVHUWHGE\WKHYHULILHU SXEOLFVWDWLFYRLGPDLQ^ LIBBPDLQ&KHFNHG IDOVH^ %HJLQDXWRPDWLFDOO\JHQHUDWHGFRGH 579HULILHU&KHFN)LHOG MDYDODQJ6\VWHPµ RXWµµMDYDLR2XWSXW6WUHDPµ 579HULILHU&KHFN0HWKRG MDYDLR2XWSXW6WUHDPµ SULQWOQµ /MDYDODQJ6WULQJ9µ BBPDLQ&KHFNHG WUXH ` (QGDXWRPDWLFDOO\JHQHUDWHGFRGH 6\VWHPRXWSULQWOQ KHOORZRUOGµ ` ` Figure 4. The hello world example after it has been processed by our verification service. The vast majority of safety axioms are checked statically. Remaining checks are deferred to execution time as shown. The first check ensures that the System class exports a field named out of type OutputStream, and the second check verifies that the class OutputStream implements a method to print a string. If any violations are found during the static phase of verification, the service propagates the error to the client by forwarding a replacement class that raises a verification exception during its initialization. Hence, verification errors are handled through the regular Java exception mechanisms. Since the Java VM specification intentionally leaves the time and manner of verification undefined except to say that the checks should be performed before any affected code is executed, our approach conforms to the specification. We found that the decomposition of the verifier was instrumental in developing a high assurance implementation. The modular structure simplified manual audits, facilitated automated testing and prevented certain classes of errors. 5
6 In contrast, we found that it was hard to characterize the boundaries, configuration, and internal state of the monolithic verifiers found in commercial systems. For example, the precise set of checks performed by the Sun verifier depend on the arguments to the JVM, the class loader used, and the existence of a just-in-time compiler. In one instance, we found that specifying an incorrect length for exception descriptors caused the JVM to crash, even though the verifier contained an explicit check for this case. The crash stemmed from the compiler using the length field before the verifier checks were performed. While a factored architecture does not necessarily result in a modular system, it reduces the likelihood of such errors resulting from inter-component interactions Security Security for state-of-the-art Java virtual machines [Wallach et al.97] builds on Java s stack-based execution model to express security policies and requires explicit calls from code modules. Access rights are granted by annotating a virtual machine s execution stack. And, they are checked by searching the stack for these annotations. As a result, security for current Java VMs is closely coupled to the virtual machine implementation and to the code executing on it. The security policy is embedded in the code, has no external specification, and, to change a given security policy, all affected code modules have to be rewritten. Our security services are designed around three principles [Grimm&Bershad97] that address these problems. First, code should be separated from the specification of the corresponding security policy. This separation ensures that a code module s security requirements are clearly documented, can be changed independently of the code, and can be centrally managed. Furthermore, a distinct security policy specification can be mechanically processed, thus permitting high-level reasoning about a system s security behavior. Second, the interpretation of a given policy should be separated from the actual enforcement of that policy. This separation enables the factoring and consequent distribution of system security, and accounts for changing security models and policies. Third, system security should be transparent to an actual code module in the absence of security violations. This transparency simplifies the development of new code modules, and provides a means for imposing security constraints on legacy code. Consistent with these principles and our overall architecture, we provide system security in a centralized security policy service and a per-machine enforcement manager. The policy service interprets an organization s security policy and, using the binary rewriter, modifies incoming code accordingly. The policy is specified in an XML-based [W3C 98] language, is distinct from code, and reflects an organization s specific security requirements. While XML is somewhat verbose and complex to parse, it is emerging as the lingua franca for Internet-based data representation. Consequently, we expect wide-spread support for XML in editors, browsers and programming environments, making an XML-based policy language a solid foundation for building policy editors and automated analysis tools. The enforcement manager resolves access checks on a client s resources and maintains the corresponding security state. To perform a check, the enforcement manager dynamically queries the policy service for the current security constraints on a resource, thus ensuring that it always sees an up-to-date view of the policy. Our security specification language is based on two abstractions. It uses security identifiers to represent principals and resources, and permissions to represent the right to perform an operation. Both abstractions also form the basis for the communication protocol between the enforcement manager, which treats them as opaque tokens, and the security policy manager, which interprets them to perform actual policy decisions. The specification language supports three major constructs. The first construct, <namespace>, maps named resources to security identifiers, similar to the name-based security attributes in domain and type enforcement [Badger et al. 95a, Badger et al. 95b]. The second construct, <access-matrix>, specifies legal permissions for pairs of security identifiers [Lampson 71]. It also specifies how to perform transfers between protection domains. The third construct, <class>, specifies where and how to insert calls to the enforcement manager in a code module. In order to facilitate the exchange of code and security specifications between organizations, our security services use the same data types and representations as the Simple Public Key Infrastructure (SPKI) [Ellison et al. 98]. SPKI is being developed within the Internet Engineering Task Force as a standard for remote authentication and access control based on public keys. Its main contributions are a notion of key-based principals and a simple, yet effective naming system. In our security services, all pertinent representations, such as security identifiers and permissions, are based on SPKI. Furthermore, like SPKI, we use canonical s-expressions [Rivest 97] as the on-the-wire format between the enforcement manager and the security policy service. Example To illustrate our security specification language and the operation of our security services, consider the example of restricting file access by applets to only read files under the SXEOLF directory of the file system. First, we need to 6
7 define the appropriate security identifiers (SIDs) and permissions. We use the DSSOHW SID to represent applet threads, and the SXEOLFILOH SID to represent files under the SXEOLF directory. Furthermore, we use the IVUHDG permission to represent the right to read files. Next, we need to create a policy specification in our policy specification language. As part of this policy, we need to define a mapping from the file system name space to security identifiers: QDPHVSDFHQDPH µivµgluhfwlrq µohiwwruljkwµvhsdudwru µµ! QRGHSDWK µsxeolfµpds µlqfoµ! QDPH!SXEOLFILOHQDPH! ILOHQDPH! QRGH! QDPHVSDFH! This specification defines a new namespace, called IV, whose names are interpreted from the left to the right and which uses the slash character to separate path components. The namespace has one node with path SXEOLF. As indicated by the map attribute, all names in the namespace that have this path as a prefix, including the path SXEOLF itself, map to the SXEOLFILOH SID. Next, we need to grant applets read access to public files. We thus add the IVUHDG tag to the access matrix entry for the SIDs DSSOHW and SXEOLFILOH (not shown). Next, we need to define how and when the enforcement manager is invoked from applets and from the classes that provide file system access. Due to space constraints, we only show this specification for a stripped version of class MDYDLR)LOH,QSXW6WUHDP, which provides read access to files. We omit the specification for other relevant classes, such as MDYDLR)LOH2XWSXW6WUHDP or MDYDDSSOHW$SSOHW. The specification for class MDYDLR)LOH,QSXW6WUHDP and the accordingly rewritten code are as follows: FODVVQDPH µmdydlr)loh,qsxw6wuhdpµ! FRQVWUXFWRUQDPH µ)loh,qsxw6wuhdp6wulqjµ! UHJLVWHUIRU U µremhfwµiurp µsdudpµlqgh[ µµqdphvsdfh µivµ! FRQVWUXFWRU! PHWKRGQDPH µlqwuhdgµ! FKHFNRQ µremhfwµ! WDJ!IVUHDGWDJ! FKHFN! PHWKRG! SXEOLFFODVVMDYDLR)LOH,QSXW6WUHDP^ FODVV! SXEOLF)LOH,QSXW6WUHDP6WULQJQDPH^ (QIRUFHPHQW0DQDJHUUHJLVWHUWKLVQDPH IVµ «` SXEOLFLQWUHDG^ (QIRUFHPHQW0DQDJHUFKHFNWKLV IVUHDGµ «` ` The specification requires that two calls to the enforcement manager be injected into class MDYDLR)LOH,QSXW6WUHDP. First, a register operation has to be injected into the constructor. This operation associates the new file input stream object with the SID corresponding to the 6WULQJ parameter in the IV namespace. Second, an access check has to be inserted into the UHDG method. This operation verifies that the current thread has the IVUHDG permission on the current file input stream object. Now, whenever a new file input stream object is created in a virtual machine, the register operation is executed. The enforcement manager for that VM queries the security policy service for the corresponding SID, providing the QDPH argument and the IV namespace, and establishes a mapping from the object to the resulting SID. If the file input stream object represents a file under the SXEOLF directory, it will be associated with the SXEOLFILOH SID; if not, it 7
8 will be associated with the null SID. On invocation of the UHDG method, the access check is executed. The enforcement manager retrieves the SID for the calling thread, which is established at thread creation time and changed on protection domain transfers, and the SID for the file input stream from its security state. It then queries the security policy service for the legal permissions for this pair of SIDs and compares the result with the required permission IVUHDG. If the calling thread is an applet thread and the file input stream object is associated with the SXEOLFILOH SID, the legal permissions include the required permission and the operation is complete. If the legal permissions do not include the required permission, the enforcement manager throws a security exception in the form of a MDYDODQJ6HFXULW\([FHSWLRQ object and thus terminates the call to the UHDG method Compilation We are currently in the process of implementing a Java compiler within this architecture. We will report on its design and implementation in the final version of the paper Client Runtime We have built our own Java runtime to facilitate research with service placement. The runtime implements core services, such as threading, memory management, I/O and synchronization that applications require at execution time. Our implementation provides these services for the PC and Alpha platforms, and relies on the Sun class libraries for the platform APIs. It is structured to permit the integration of virtual machine services when desired. This flexibility allows us to use the same service components under monolithic and distributed configurations. For example, the first three phases of verification can be integrated into the runtime or factored out to a network server. Since the implementation of the fourth phase is varies between architectures, we have two separate implementations. Overall, this structure allows us to evaluate comparable service implementations under different system architectures Performance Monitoring Services In order to enable virtual machines to monitor their performance and for users to observe application behavior, we implemented a profiling and tracing service. The profiler instruments code to generate a dynamic call-graph [Graham et al. 82]. The tracer instruments applications to generate a timestamped log of all calls to the system libraries [Jones 93]. While we have been using these services extensively for debugging our system, they can also be used for remote monitoring and administration Service Infrastructure A distributed architecture requires an infrastructure that ties clients together with the services they need. In our current implementation, we adopted an event based filter model for our services. An extended web proxy serves as the I/O substrate for service implementations. The proxy intercepts and processes requests from the clients. An internal filtering API allows logically separate services to be composed together on the same host. The proxy permits a caching filter to be used to avoid fetching and rewriting overhead for shared components. There is also a tracer filter which collects statistics and generates an audit trail from each proxy, and forwards the results to a remote administration console. The proxy is also responsible for housing the static and dynamic components of VM services. The static components appear to the proxy as rewriting filters which are applied to code passing through the proxy. The dynamic components, which are in essence class libraries that perform additional service functionality, are provided to the clients on demand. Centralization of service state simplifies service upgrades for organizations. While our service infrastructure requires no changes to the clients, and therefore does not control them directly, a remote management service provides centralized control. At the time a virtual machine fetches its first application, the application s startup code is rewritten to invoke the remote management service. This service then contacts the remote administration console, and a handshake protocol establishes the credentials of the user and assigns an identifier to the session. It is thus possible for a network administrator to remotely examine all hosts in an organization. 5. Evaluation In this section, we show that our architecture supports secure, manageable and scalable virtual machine services. We first demonstrate that our architecture reduces resource requirements in clients. We then examine the performance overhead of rewriting and conclude that it is negligible compared to typical latencies involved in fetching applications from a wide area network such as the Internet. We show that the rewriting services do not present 8
9 bottlenecks for medium-size networks and scale over large numbers of clients. Finally, we compare a monolithic implementation of a verifier to a distributed version, and characterize its performance. All of the measurements in this section were performed on 200 MHz PentiumPro systems running Windows NT4.0 with 64 MB of memory, connected by a 10Mb/sec Ethernet local area network. Our connection to the Internet is through two 100 Mb/sec links. At the time of the experiments, the links were lightly loaded, with less than 40 Mb/sec peak consumed bandwidth. Code size Data size Sun JDK Netscape JVM Microsoft JVM Factored JVM Table 1. Static code and data sizes, in bytes, for monolithic and factored virtual machines. The static code and data sizes for different JVM clients are shown in Table 1. The Sun JDK is the reference Java virtual machine (version 1.1.5) from Sun Microsystems. The Netscape and Microsoft JVMs are the versions shipped with the latest browsers by their respective vendors. The measurements for Sun and Netscape exclude the space required for the native AWT implementation, since our factored JVM does not support a windowing system. We could not factor out the size of the AWT libraries from the Microsoft virtual machine because they are bundled into a single library along with the rest of the VM. The measurements demonstrate that a factored architecture requires less resources than a comparable monolithic implementation. SUN JDK Factored JVM Common Verifier Security Interpreter Runtime Profiler Disassembler Proxy Figure 5. Module lengths of factored and monolithic virtual machines. Figure 5 evaluates the impact of factoring services on code structure. Services in our factored implementation share a large common code base. Overall, our system consists of lines of code, whereas the monolithic Sun JDK implementation is comprised of roughly lines, not counting the native AWT library implementation. We attribute this difference mostly to functionality in our factored virtual machine that the monolithic JVM does not provide. For example, there is no equivalent functionality in the Sun JDK to our proxy, rewriting service, or external security specification. 9
10 Graph 1 shows the overhead associated with downloading applets through our service infrastructure. We collected a list of all indexed Java applets from the AltaVista search engine, and randomly selected a subset of 75 applets around the Internet. The scatter plot shows the difference between directly fetching these classes from the Internet versus fetching them through our service proxy. Going through our service infrastructure entailed an average delay of 71 milliseconds. This represents a 5% overhead compared to our observed average latency of 1536 milliseconds to download an applet. Given the wide variation, sometimes as high as 15%, we encountered in successive runs of this experiment, the rewriting overhead is small. We then examine the scaling characteristics of the system for large numbers of clients [Graph 2]. We disabled caching in the proxy, and simulated up to 250 clients simultaneously fetching different applets. The graph shows the total proxy throughput as a function of the number of clients. The measurements represent the sustained throughput in our system. Based on these numbers, we conclude that the proxy does not pose a bottleneck for small to medium size networks. In larger installations, the proxy can simply be replicated to handle the increased load. Finally, we compare our factored verifier to two monolithic verifier implementations. The first is the Sun JDK verifier, which is a highly tuned commercial product. The second is our own verifier integrated into our runtime in a monolithic configuration. We found that, for a large application, namely the Java web server from Sun, verification took seconds under the Sun JDK verifier, seconds under our monolithic configuration, and seconds in our factored implementation. The factored verifier spends 42% of its time interpreting bytecodes that perform the phase four link checks in Java. We expect this time to be reduced significantly when the bytecodes are compiled. In addition, our system has not yet been optimized. 6. Related Work Total Throughput (bytes/sec) Time (sec) Applet Download Latency Size (bytes) Proxy Throughput vs. Number of Clients Number of Clients Graph 2. Sustained throughput of our VM services versus number of clients. While virtual machines have evolved extensively since their introduction, their monolithic architecture has remained unchanged. The first commercial virtual machine was the IBM VM system [IBMVM86], which made its commercial debut in The IBM VM system enabled organizations to run both MVS and CMS on the same physical machine by virtualizing machine resources. As a result of the monolithic structure, all VM services were executed on the same host [Deitel 90]. This structure has influenced many of the virtual machine implementations that followed. In the early 1970 s, virtual machines were also adopted by the language community as a substrate for distributed code. These systems used virtual machines both to retain the portability of applications in an increasingly heterogeneous environment, and to provide high-level abstractions for which compilers could generate code more Proxy No Proxy Graph 1. Time to download an applet directly from the Internet versus through our service infrastructure. 10
11 easily. P-Code [Psystem] is one such intermediate language that was widely used as part of the UCSD Pascal system. It offered cross-platform portability by targeting a pseudo-machine for compilation, and relying on a runtime interpreter. While the P-System disappeared over time as it did not provide safety guarantees, its portability did influence modern virtual machine design. Recent virtual machines such as Java and Inferno build on this legacy to provide safety, portability and uniformity in a network computing setting. They rely on a growing set of complex services [Gosling&Yellin 96, Myers&Liskov97, Wallach et al.97] to provide their functionality. We believe that a factored architecture addresses the problems faced by these systems. The CAGE system from Digitivity takes an alternative approach to factoring services out of clients [Digitivity 97]. CAGE replaces all virtual machines in an organization with a single virtual machine that is physically isolated behind a firewall. All applications execute on this centralized virtual machine, and communicate with clients only for user-interface operations. While this approach has the property that clients are not exposed to untrusted code, it does not address issues of secure sharing of client resources. As a result, while it may be applicable to stateless applets on the web, it does not support applications which require selective access to local resources found on clients. There are parallels between our work and the use of firewalls for network security [Cheswick&Bellovin94, Mogul et al. 87]. Before the emergence of firewalls, every networked host in an organization had to be protected against all bad packets that it might receive. The rapid acceptance of firewalls demonstrated that it was simpler and more secure to concentrate functionality in a single packet-filter rather than to secure every host in an organization. Modern virtual machines present a similar challenge, except that the services are considerably more complex than packet filtering. 7. Conclusions We have designed and implemented a new system architecture for network computing based on distributed virtual machines. Our system factors virtual machine services out of clients and locates them in enterprise-wide network servers. The services operate by intercepting application code and modifying it on the fly to provide service functionality. This architecture reduces client resource demands and the size of the trusted computing base, establishes physical isolation between virtual machine services and creates a single point of administration. Such a distributed virtual machine architecture can provide substantially better integrity and manageability than a monolithic architecture, scales well with increasing numbers of clients, and has comparably low overhead. 8. Acknowledgements We would like to thank Jim Roskind of Netscape, Charles Fitzgerald and Kory Srock of Microsoft, and Tim Lindholm, Sheng Liang, Marianne Mueller and Li Gong of Javasoft for discussing the internals of their systems with us. Sean McDirmid implemented parts of our verifier. Bibek Pandey collected the list of applets that were used in our performance evaluation. 9. References [Accetta et al. 89] Accetta, M. J., Baron, R. V., Bolosky, W., Golub, D. B., Rashid R. F., Tevanian, A. and Young, M. W. Mach: A New Kernel Foundation for Unix Development. USENIX [Adl-Tabatabai et al. 96] Adl-Tabatabai, A., Langdale, G., Lucco, S. and Wahbe, R. Efficient and Language- Independent Mobile Programs." In Conference on Programming Language Design and Implementation, May, 1996, p [Badger et al. 95a] L. Badger, D. F. Sterne, D. L. Sherman, K. M. Walker, and S. A. Haghighat. Pratical Domain and Type Enforcement for UNIX. In Proceedings of the 1995 IEEE Symposium on Security and Privacy, pages 66-77, Oakland, California, May [Badger et al. 95b] L. Badger, D. F. Sterne, D. L. Sherman, K. M. Walker, and S. A. Haghighat. A Domain and Type Enforcement UNIX Prototype. In Proceedings of the Fifth USENIX UNIX Security Symposium, pages , Salt Lake City, Utah, June [Bershad et al. 95] Bershad, B. N., Savage, S., Pardyak, P., Sirer, E. G., Fiuczynski, M., Becker, D., Eggers, S., Chambers, C. Extensibility, Safety and Performance in the SPIN Operating System. In Proceedings of the Symposium on Operating System Principles, [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", RFC 1157, May
12 [Cheswick&Bellovin94] Cheswick, W. R. and Bellovin, S. Firewalls and Internet Security: Repelling the Wily Hacker. Addison-Wesley, [Custer 93] Custer, H. Inside Windows NT. Microsoft Press, [Dean et al. 97] Dean, D., Felten, E. W., Wallach, D. S. and Belfanz, D. Java Security: Web Browers and Beyond. In Internet Beseiged: Countering Cyberspace Scofflaws, D. E. Denning and P. J. Denning, eds. ACM Press, October [Deitel 90] Deitel, H. M. An introduction to Operating Systems. Addison-Wesley, Reading, MA [Digitivity 97] Digitivity, Inc. Digitivity Introduces the First Internet Applet Management System for the Secure Deployment of JAVA. June [Ellison et al. 98] C. M. Ellison, B. Frantz, B. Lampson, R. Rivest, B. M. Thomas, T. Ylonen. Simple Public Key Infrastructure. Internet Draft, Internet Engineering Task Force, March [Engler et al. 95] Engler, D. R., Kaashoek, M. F. and O'Toole, J. "Exokernel: An Operating System Architecture for Application-Level Resource Management. In Proceedings of the Symposium on Operating System Principles, [Freund&Mitchell 98] Freund, S. N. and Mitchell, J. C. A type system for object initialization in the Java Bytecode Language. To appear in ACM Conference on Object-Oriented Programming: Systems, Languages and Applications, [Gosling&Yellin 96] Gosling, J. and Yellin, F. The Java Application Programming Interface, Volumes 1 & 2. Addison-Wesley, [Graham et al. 82] Graham, S.L., Kessler, P.B. and McKusick, M.K. gprof: A Call Graph Execution Profiler. In Proceedings of the SIGPLAN '82 Symposium on Compiler Construction, SIGPLAN Notices, Vol. 17, No. 6, pp , June [Grimm&Bershad97] Grimm, R. and Bershad, B. Providing Policy-Neutral and Transparent Access Control in Extensible Systems. Technical Report UW-CSE , February [IBMVM86] IBM Corporation. Virtual Machine/System Product Application Development Guide, Release 5. Endicott, New York, [Inferno] [Jones 93] Lucent Technologies. Inferno. Jones, M. B. "Interposition Agents: Transparently Interposing User Code at the System Call." In Proceedings of the Symposium on Operating System Principles, December 1993, pp [Lampson 71] B. W. Lampson. Protection. In Proceedings of the Fifth Princeton Symposium on Information Sciences and Systems, pages , Princeton, New Jersey, March Reprinted in Operating Systems Review, 8(1):18-24, January [Lindholm&Yellin96] Lindholm, T. and Yellin, F. The Java Virtual Machine Specification. Addison-Wesley, [Madany 96] Madany, P. JavaOS Java on the Bare Metal. JavaOne [Mogul et al. 87] [Myers&Liskov97] Mogul, J. C., Rashid, R. F. and Accetta, M. J. The Packet Filter: An Efficient Mechanism for User-level Network Code." In Proceedings of the Symposium on Operating System Principles, November 1987, pp Myers, A. C. and Liskov, B. A Decentralized Model for Information Flow Control. In Proceedings of the Symposium on Operating System Principles, 1997 [Saltzer&Schroeder 75] Saltzer, J. H. and Schroeder, M. D. The Protection of Information in Computer Systems. In Proceedings of the IEEE, 63(9): , September [Rivest 97] R. Rivest. S-Expressions. Internet Draft, Internet Engineering Task Force, May [Sirer et al. 98] [Spyglass 94] [Stata&Abadi 98] [Tanenbaum et al. 90] Sirer, E. G., Grimm, R., Bershad, B. N., Gregory, A. J. and McDirmid, S. Distributed Virtual Machines: A System Architecture for Network Computing. European SIGOPS, September Software Development Interface for Dynamic Data Exchange. products/smosaic/sdi/sdi_spec.html Stata, R. and Abadi, M. A type system for Java bytecode subroutines. In Proceedings of the 25th Symposium on Principles of Programming Languages, January 1998, p Tanenbaum, A.S., Renesse, R. van, Staveren, H. van., Sharp, G.J., Mullender, S.J., Jansen, A.J., and Rossum, G. van: "Experiences with the Amoeba Distributed Operating System," Commun. ACM, vol. 33, pp , Dec [Thompson 84] K. Thompson. Reflections on Trusting Trust. Communication of the ACM, Vol. 27, No. 8, August 1984, pp
13 [Psystem] University of California, Irvine. p-system: Description, Background, Utilities. [W3C 98] World Wide Web Consortium. Extensible Markup Language (XML) 1.0. Edited by T. Bray, J. Paoli, C. M. Sperberg-McQueen, February [Wallach et al.97] Wallach, D. S., Balfanz, D., Dean, D. and Felten, E. W. Extensible Security Architectures for Java. In Proceedings of the Symposium on Operating System Principles, [Walker et al.83] Walker, B., Popek, G., English, R., Kline, C. and Thiel, G. The LOCUS Distributed Operating System. In Proceedings of the Symposium on Operating System Principles, 1983, p
Design and implementation of a distributed virtual machine for networked computers
17th ACM Symposium on Operating System Principles (SOSP 99) Published as Operating Systems Review 34(5):202 216, Dec. 1999 Design and implementation of a distributed virtual machine for networked computers
Security for Extensible Systems
Security for Extensible Systems Robert Grimm Brian N. Bershad frgrimm, bershadg@cs.washington.edu Dept. of Computer Science and Engineering University of Washington Seattle, WA 98195, U.S.A. Abstract The
Testing Java Virtual Machines
Testing Java Virtual Machines An Experience Report on Automatically Testing Java Virtual Machines Emin Gün Sirer Dept. of Computer Science and Engineering University of Washington, Box 352350 Seattle,
Smokey: A User-Based Distributed Firewall System
Smokey: A User-Based Distributed Firewall System Rachel Rubin Department of Computer Science University of California, Berkeley Berkeley, CA 94704 rrubin@cs.berkeley.edu Abstract Traditional intranets
CSCI E 98: Managed Environments for the Execution of Programs
CSCI E 98: Managed Environments for the Execution of Programs Draft Syllabus Instructor Phil McGachey, PhD Class Time: Mondays beginning Sept. 8, 5:30-7:30 pm Location: 1 Story Street, Room 304. Office
Hardware/Software Co-Design of a Java Virtual Machine
Hardware/Software Co-Design of a Java Virtual Machine Kenneth B. Kent University of Victoria Dept. of Computer Science Victoria, British Columbia, Canada ken@csc.uvic.ca Micaela Serra University of Victoria
SiteCelerate white paper
SiteCelerate white paper Arahe Solutions SITECELERATE OVERVIEW As enterprises increases their investment in Web applications, Portal and websites and as usage of these applications increase, performance
Interpreters and virtual machines. Interpreters. Interpreters. Why interpreters? Tree-based interpreters. Text-based interpreters
Interpreters and virtual machines Michel Schinz 2007 03 23 Interpreters Interpreters Why interpreters? An interpreter is a program that executes another program, represented as some kind of data-structure.
Cloud Computing. Up until now
Cloud Computing Lecture 11 Virtualization 2011-2012 Up until now Introduction. Definition of Cloud Computing Grid Computing Content Distribution Networks Map Reduce Cycle-Sharing 1 Process Virtual Machines
Decomposition into Parts. Software Engineering, Lecture 4. Data and Function Cohesion. Allocation of Functions and Data. Component Interfaces
Software Engineering, Lecture 4 Decomposition into suitable parts Cross cutting concerns Design patterns I will also give an example scenario that you are supposed to analyse and make synthesis from The
PART IV Performance oriented design, Performance testing, Performance tuning & Performance solutions. Outline. Performance oriented design
PART IV Performance oriented design, Performance testing, Performance tuning & Performance solutions Slide 1 Outline Principles for performance oriented design Performance testing Performance tuning General
1. Overview of the Java Language
1. Overview of the Java Language What Is the Java Technology? Java technology is: A programming language A development environment An application environment A deployment environment It is similar in syntax
Chapter 2 TOPOLOGY SELECTION. SYS-ED/ Computer Education Techniques, Inc.
Chapter 2 TOPOLOGY SELECTION SYS-ED/ Computer Education Techniques, Inc. Objectives You will learn: Topology selection criteria. Perform a comparison of topology selection criteria. WebSphere component
AN EXPERIMENTAL COMPARISON OF REMOTE PROCEDURE CALL AND GROUP COMMUNICATION
AN EXPERIMENTAL COMPARISON OF REMOTE PROCEDURE CALL AND GROUP COMMUNICATION M. Frans Kaashoek Andrew S. Tanenbaum Kees Verstoep ABSTRACT This paper suggests that a distributed system should support two
Research on the Model of Enterprise Application Integration with Web Services
Research on the Model of Enterprise Integration with Web Services XIN JIN School of Information, Central University of Finance& Economics, Beijing, 100081 China Abstract: - In order to improve business
Checking Access to Protected Members in the Java Virtual Machine
Checking Access to Protected Members in the Java Virtual Machine Alessandro Coglio Kestrel Institute 3260 Hillview Avenue, Palo Alto, CA 94304, USA Ph. +1-650-493-6871 Fax +1-650-424-1807 http://www.kestrel.edu/
Distribution transparency. Degree of transparency. Openness of distributed systems
Distributed Systems Principles and Paradigms Maarten van Steen VU Amsterdam, Dept. Computer Science steen@cs.vu.nl Chapter 01: Version: August 27, 2012 1 / 28 Distributed System: Definition A distributed
Test Run Analysis Interpretation (AI) Made Easy with OpenLoad
Test Run Analysis Interpretation (AI) Made Easy with OpenLoad OpenDemand Systems, Inc. Abstract / Executive Summary As Web applications and services become more complex, it becomes increasingly difficult
The Service Availability Forum Specification for High Availability Middleware
The Availability Forum Specification for High Availability Middleware Timo Jokiaho, Fred Herrmann, Dave Penkler, Manfred Reitenspiess, Louise Moser Availability Forum Timo.Jokiaho@nokia.com, Frederic.Herrmann@sun.com,
OpenHRE Security Architecture. (DRAFT v0.5)
OpenHRE Security Architecture (DRAFT v0.5) Table of Contents Introduction -----------------------------------------------------------------------------------------------------------------------2 Assumptions----------------------------------------------------------------------------------------------------------------------2
An Overview of Virtual Machine Architectures
An Overview of Virtual Machine Architectures J. E. Smith October 27, 2001 1 Introduction When early computer systems were being developed, hardware was designed first, and machine-level software followed.
CheckPoint FireWall-1 Version 3.0 Highlights Contents
CheckPoint FireWall-1 Version 3.0 Highlights Contents Abstract...2 Active Network Management...3 Accounting... 3 Live Connections Report... 3 Load balancing... 3 Exporting log records to Informix database...
Replication on Virtual Machines
Replication on Virtual Machines Siggi Cherem CS 717 November 23rd, 2004 Outline 1 Introduction The Java Virtual Machine 2 Napper, Alvisi, Vin - DSN 2003 Introduction JVM as state machine Addressing non-determinism
Java Smart Cards as a Platform for Electronic Commerce
Java Smart Cards as a Platform for Electronic Commerce 1 Java Smart Cards as a Platform for Electronic Commerce Joachim Posegga Deutsche Telekom AG Technologiezentrum IT Sicherheit/FE34a D-64276 Darmstadt
A Java-based system support for distributed applications on the Internet
A Java-based system support for distributed applications on the Internet D. Hagimont 1, D. Louvegnies 2 SIRAC Project INRIA, 655 av. de l Europe, 38330 Montbonnot Saint-Martin, France Abstract: We have
Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.
Considerations In Developing Firewall Selection Criteria Adeptech Systems, Inc. Table of Contents Introduction... 1 Firewall s Function...1 Firewall Selection Considerations... 1 Firewall Types... 2 Packet
COM 444 Cloud Computing
COM 444 Cloud Computing Lec 3: Virtual Machines and Virtualization of Clusters and Datacenters Prof. Dr. Halûk Gümüşkaya haluk.gumuskaya@gediz.edu.tr haluk@gumuskaya.com http://www.gumuskaya.com Virtual
TECHNOLOGY WHITE PAPER. Application Performance Management. Introduction to Adaptive Instrumentation with VERITAS Indepth for J2EE
TECHNOLOGY WHITE PAPER Application Performance Management Introduction to Adaptive Instrumentation with VERITAS Indepth for J2EE TABLE OF CONTENTS ABOUT ADAPTIVE INSTRUMENTATION 3 WHY ADAPTIVE INSTRUMENTATION?
Coda: A Highly Available File System for a Distributed Workstation Environment
Coda: A Highly Available File System for a Distributed Workstation Environment M. Satyanarayanan School of Computer Science Carnegie Mellon University Abstract Coda is a file system for a large-scale distributed
Chapter 3 Operating-System Structures
Contents 1. Introduction 2. Computer-System Structures 3. Operating-System Structures 4. Processes 5. Threads 6. CPU Scheduling 7. Process Synchronization 8. Deadlocks 9. Memory Management 10. Virtual
Monitoring, Tracing, Debugging (Under Construction)
Monitoring, Tracing, Debugging (Under Construction) I was already tempted to drop this topic from my lecture on operating systems when I found Stephan Siemen's article "Top Speed" in Linux World 10/2003.
PERFORMANCE MONITORING OF JAVA COMPONENT-ORIENTED DISTRIBUTED APPLICATIONS
PERFORMANCE MONITORING OF JAVA COMPONENT-ORIENTED DISTRIBUTED APPLICATIONS Adrian Mos, John Murphy Performance Engineering Lab, Dublin City University Glasnevin, Dublin 9, Ireland Tel: +353 1 700-8762,
Affordable, Scalable, Reliable OLTP in a Cloud and Big Data World: IBM DB2 purescale
WHITE PAPER Affordable, Scalable, Reliable OLTP in a Cloud and Big Data World: IBM DB2 purescale Sponsored by: IBM Carl W. Olofson December 2014 IN THIS WHITE PAPER This white paper discusses the concept
Risks with web programming technologies. Steve Branigan Lucent Technologies
Risks with web programming technologies Steve Branigan Lucent Technologies Risks with web programming technologies Abstract Java applets and their kind are bringing new life to the World Wide Web. Through
Garbage Collection in the Java HotSpot Virtual Machine
http://www.devx.com Printed from http://www.devx.com/java/article/21977/1954 Garbage Collection in the Java HotSpot Virtual Machine Gain a better understanding of how garbage collection in the Java HotSpot
The Software Container pattern
The Software Container pattern Madiha H. Syed and Eduardo B. Fernandez Dept. of Computer and Elect. Eng. and Computer Science Florida Atlantic University, Boca Raton, FL 33431, USA msyed2014@fau.edu, ed@cse.fau.edu
Virtual Machines. www.viplavkambli.com
1 Virtual Machines A virtual machine (VM) is a "completely isolated guest operating system installation within a normal host operating system". Modern virtual machines are implemented with either software
Agent Languages. Overview. Requirements. Java. Tcl/Tk. Telescript. Evaluation. Artificial Intelligence Intelligent Agents
Agent Languages Requirements Overview Java Tcl/Tk Telescript Evaluation Franz J. Kurfess, Cal Poly SLO 211 Requirements for agent Languages distributed programming large-scale (tens of thousands of computers)
BlackBerry Enterprise Service 10. Secure Work Space for ios and Android Version: 10.1.1. Security Note
BlackBerry Enterprise Service 10 Secure Work Space for ios and Android Version: 10.1.1 Security Note Published: 2013-06-21 SWD-20130621110651069 Contents 1 About this guide...4 2 What is BlackBerry Enterprise
Distributed Objects and Components
Distributed Objects and Components Introduction This essay will identify the differences between objects and components and what it means for a component to be distributed. It will also examine the Java
Introduction to Virtual Machines
Introduction to Virtual Machines Introduction Abstraction and interfaces Virtualization Computer system architecture Process virtual machines System virtual machines 1 Abstraction Mechanism to manage complexity
RE-TRUST Design Alternatives on JVM
RE-TRUST Design Alternatives on JVM ( - Italy) paolo.falcarin@polito.it http://softeng.polito.it/falcarin Trento, December, 19 th 2006 Tamper-Detection Tamper-detection goals Detect malicious modifications
vsphere Upgrade vsphere 6.0 EN-001721-03
vsphere 6.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document,
New Methods for Performance Monitoring of J2EE Application Servers
New Methods for Performance Monitoring of J2EE Application Servers Adrian Mos (Researcher) & John Murphy (Lecturer) Performance Engineering Laboratory, School of Electronic Engineering, Dublin City University,
Project Software Security: Securing SendMail with JAAS and Polymer
Project Software Security: Securing SendMail with JAAS and Polymer Frank van Vliet frank@pine.nl Diego Ortiz Yepes d.a.ortiz.yepes@student.tue.nl Jornt van der Wiel j.h.v.d.wiel@student.tue.nl Guido Kok
A NOVEL ARCHITECTURE FOR DYNAMIC LEAST COST ROUTING
A NOVEL ARCHITECTURE FOR DYNAMIC LEAST COST ROUTING Peer Hasselmeyer Information technology Transfer Office, Darmstadt University of Technology Wilhelminenstr. 7, 64283 Darmstadt, Germany E-mail: peer@ito.tu-darmstadt.de
Restraining Execution Environments
Restraining Execution Environments Segurança em Sistemas Informáticos André Gonçalves Contents Overview Java Virtual Machine: Overview The Basic Parts Security Sandbox Mechanisms Sandbox Memory Native
Service Virtualization: Managing Change in a Service-Oriented Architecture
Service Virtualization: Managing Change in a Service-Oriented Architecture Abstract Load balancers, name servers (for example, Domain Name System [DNS]), and stock brokerage services are examples of virtual
Building Applications Using Micro Focus COBOL
Building Applications Using Micro Focus COBOL Abstract If you look through the Micro Focus COBOL documentation, you will see many different executable file types referenced: int, gnt, exe, dll and others.
WHITE PAPER. Best Practices for Configuring PATROL for Microsoft Exchange Servers
WHITE PAPER Best Practices for Configuring PATROL for Microsoft Exchange Servers Contents INTRODUCTION..................................................... 3 PATROL SECURITY....................................................
Characteristics of Java (Optional) Y. Daniel Liang Supplement for Introduction to Java Programming
Characteristics of Java (Optional) Y. Daniel Liang Supplement for Introduction to Java Programming Java has become enormously popular. Java s rapid rise and wide acceptance can be traced to its design
A Java Filter. Edward W. Felten. Dirk Balfanz. Abstract. 1 Introduction
A Java Filter Dirk Balfanz Princeton University balfanz@cs.princeton.edu Edward W. Felten Princeton University felten@cs.princeton.edu Abstract Rogue Java applets are currently a major concern for big
1 Organization of Operating Systems
COMP 730 (242) Class Notes Section 10: Organization of Operating Systems 1 Organization of Operating Systems We have studied in detail the organization of Xinu. Naturally, this organization is far from
How To Create A C++ Web Service
A Guide to Creating C++ Web Services WHITE PAPER Abstract This whitepaper provides an introduction to creating C++ Web services and focuses on:» Challenges involved in integrating C++ applications with
IBM SPSS Collaboration and Deployment Services Version 6 Release 0. Single Sign-On Services Developer's Guide
IBM SPSS Collaboration and Deployment Services Version 6 Release 0 Single Sign-On Services Developer's Guide Note Before using this information and the product it supports, read the information in Notices
Reconfigurable Architecture Requirements for Co-Designed Virtual Machines
Reconfigurable Architecture Requirements for Co-Designed Virtual Machines Kenneth B. Kent University of New Brunswick Faculty of Computer Science Fredericton, New Brunswick, Canada ken@unb.ca Micaela Serra
Caché License Management
Caché License Management Version 5.0.17 30 June 2005 InterSystems Corporation 1 Memorial Drive Cambridge MA 02142 www.intersystems.com Caché License Management InterSystems Version 5.0.17 30 June 2005
Oracle JRockit Mission Control Overview
Oracle JRockit Mission Control Overview An Oracle White Paper June 2008 JROCKIT Oracle JRockit Mission Control Overview Oracle JRockit Mission Control Overview...3 Introduction...3 Non-intrusive profiling
What Is the Java TM 2 Platform, Enterprise Edition?
Page 1 de 9 What Is the Java TM 2 Platform, Enterprise Edition? This document provides an introduction to the features and benefits of the Java 2 platform, Enterprise Edition. Overview Enterprises today
Niagara IT Manager s Guide
3951 Westerre Parkway, Suite 350 Richmond, VA 23233 804.747.4771 Phone 804.747.5204 FAX Niagara IT Manager s Guide A White Paper An IT Manager s Guide to Niagara This document addresses some of the common
x86 ISA Modifications to support Virtual Machines
x86 ISA Modifications to support Virtual Machines Douglas Beal Ashish Kumar Gupta CSE 548 Project Outline of the talk Review of Virtual Machines What complicates Virtualization Technique for Virtualization
Distributed and Cloud Computing
Distributed and Cloud Computing K. Hwang, G. Fox and J. Dongarra Chapter 3: Virtual Machines and Virtualization of Clusters and datacenters Adapted from Kai Hwang University of Southern California March
A Comparison on Current Distributed File Systems for Beowulf Clusters
A Comparison on Current Distributed File Systems for Beowulf Clusters Rafael Bohrer Ávila 1 Philippe Olivier Alexandre Navaux 2 Yves Denneulin 3 Abstract This paper presents a comparison on current file
Secure Mobile Agent Systems Using Java: Where are We Heading?
Secure Mobile Agent Systems Using Java: Where are We Heading? Walter Binder CoCo Software Engineering Margaretenstr. 22/9, 1040 Vienna, Austria w.binder@coco.co.at Volker Roth Fraunhofer IGD Rundeturmstr.
Java and Java Virtual Machine Security
Java and Java Virtual Machine Security Vulnerabilities and their Exploitation Techniques by Last Stage of Delirium Research Group http://lsd-pl.net Version: 1.0.0 Updated: October 2nd, 2002 Copyright c
SOFT 437. Software Performance Analysis. Ch 5:Web Applications and Other Distributed Systems
SOFT 437 Software Performance Analysis Ch 5:Web Applications and Other Distributed Systems Outline Overview of Web applications, distributed object technologies, and the important considerations for SPE
Service Oriented Architectures
8 Service Oriented Architectures Gustavo Alonso Computer Science Department Swiss Federal Institute of Technology (ETHZ) alonso@inf.ethz.ch http://www.iks.inf.ethz.ch/ The context for SOA A bit of history
Architecture of a Distributed Object Firewall Proxy. Abstract
NAI Labs #0768 Architecture of a Distributed Object Firewall Proxy July 16, 2000 Gary Lamperillo Gary_Lamperillo@NAI.com NAI Labs - The Security Research Division Network Associates 3415 S. Sepulveda Blvd.
Building A Secure Microsoft Exchange Continuity Appliance
Building A Secure Microsoft Exchange Continuity Appliance Teneros, Inc. 215 Castro Street, 3rd Floor Mountain View, California 94041-1203 USA p 650.641.7400 f 650.641.7401 ON AVAILABLE ACCESSIBLE Building
Design Issues in a Bare PC Web Server
Design Issues in a Bare PC Web Server Long He, Ramesh K. Karne, Alexander L. Wijesinha, Sandeep Girumala, and Gholam H. Khaksari Department of Computer & Information Sciences, Towson University, 78 York
Online Recruitment System 1. INTRODUCTION
1. INTRODUCTION This project Online Recruitment System is an online website in which jobseekers can register themselves online and apply for job and attend the exam. Online Recruitment System provides
Technical White Paper BlackBerry Enterprise Server
Technical White Paper BlackBerry Enterprise Server BlackBerry Enterprise Edition for Microsoft Exchange For GPRS Networks Research In Motion 1999-2001, Research In Motion Limited. All Rights Reserved Table
Binonymizer A Two-Way Web-Browsing Anonymizer
Binonymizer A Two-Way Web-Browsing Anonymizer Tim Wellhausen Gerrit Imsieke (Tim.Wellhausen, Gerrit.Imsieke)@GfM-AG.de 12 August 1999 Abstract This paper presents a method that enables Web users to surf
ORACLE DATABASE 10G ENTERPRISE EDITION
ORACLE DATABASE 10G ENTERPRISE EDITION OVERVIEW Oracle Database 10g Enterprise Edition is ideal for enterprises that ENTERPRISE EDITION For enterprises of any size For databases up to 8 Exabytes in size.
1-04-10 Configuration Management: An Object-Based Method Barbara Dumas
1-04-10 Configuration Management: An Object-Based Method Barbara Dumas Payoff Configuration management (CM) helps an organization maintain an inventory of its software assets. In traditional CM systems,
Software design (Cont.)
Package diagrams Architectural styles Software design (Cont.) Design modelling technique: Package Diagrams Package: A module containing any number of classes Packages can be nested arbitrarily E.g.: Java
Relational Databases in the Cloud
Contact Information: February 2011 zimory scale White Paper Relational Databases in the Cloud Target audience CIO/CTOs/Architects with medium to large IT installations looking to reduce IT costs by creating
Comparing Microsoft SQL Server 2005 Replication and DataXtend Remote Edition for Mobile and Distributed Applications
Comparing Microsoft SQL Server 2005 Replication and DataXtend Remote Edition for Mobile and Distributed Applications White Paper Table of Contents Overview...3 Replication Types Supported...3 Set-up &
Performance Monitoring and Tuning. Liferay Chicago User Group (LCHIUG) James Lefeu 29AUG2013
Performance Monitoring and Tuning Liferay Chicago User Group (LCHIUG) James Lefeu 29AUG2013 Outline I. Definitions II. Architecture III.Requirements and Design IV.JDK Tuning V. Liferay Tuning VI.Profiling
Glossary of Object Oriented Terms
Appendix E Glossary of Object Oriented Terms abstract class: A class primarily intended to define an instance, but can not be instantiated without additional methods. abstract data type: An abstraction
An evaluation of the Java Card environment
An evaluation of the Java Card environment Christophe Rippert, Daniel Hagimont Contact: Christophe Rippert, Sirac Laboratory INRIA Rhône-Alpes, 655 avenue de l Europe Montbonnot 38334 St Ismier Cedex,
1/20/2016 INTRODUCTION
INTRODUCTION 1 Programming languages have common concepts that are seen in all languages This course will discuss and illustrate these common concepts: Syntax Names Types Semantics Memory Management We
In this chapter, we will introduce works related to our research. First, we will
Chapter 2 Related Works In this chapter, we will introduce works related to our research. First, we will present the basic concept of directory service and Lightweight Directory Access Protocol (LDAP).
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security
Is Drupal secure? A high-level perspective on web vulnerabilities, Drupal s solutions, and how to maintain site security Presented 2009-05-29 by David Strauss Thinking Securely Security is a process, not
ZooKeeper. Table of contents
by Table of contents 1 ZooKeeper: A Distributed Coordination Service for Distributed Applications... 2 1.1 Design Goals...2 1.2 Data model and the hierarchical namespace...3 1.3 Nodes and ephemeral nodes...
Chapter 3: Operating-System Structures. Common System Components
Chapter 3: Operating-System Structures System Components Operating System Services System Calls System Programs System Structure Virtual Machines System Design and Implementation System Generation 3.1
TNT SOFTWARE White Paper Series
TNT SOFTWARE White Paper Series Event Log Monitor White Paper: Architecture T N T Software www.tntsoftware.com TNT SOFTWARE Event Log Monitor Architecture 2000 TNT Software All Rights Reserved 1308 NE
Performance Monitoring API for Java Enterprise Applications
Performance Monitoring API for Java Enterprise Applications Purpose Perfmon4j has been successfully deployed in hundreds of production java systems over the last 5 years. It has proven to be a highly successful
Tools Page 1 of 13 ON PROGRAM TRANSLATION. A priori, we have two translation mechanisms available:
Tools Page 1 of 13 ON PROGRAM TRANSLATION A priori, we have two translation mechanisms available: Interpretation Compilation On interpretation: Statements are translated one at a time and executed immediately.
Web Applications Access Control Single Sign On
Web Applications Access Control Single Sign On Anitha Chepuru, Assocaite Professor IT Dept, G.Narayanamma Institute of Technology and Science (for women), Shaikpet, Hyderabad - 500008, Andhra Pradesh,
Jonathan Worthington Scarborough Linux User Group
Jonathan Worthington Scarborough Linux User Group Introduction What does a Virtual Machine do? Hides away the details of the hardware platform and operating system. Defines a common set of instructions.
Java History. Java History (cont'd)
Java History Created by James Gosling et. al. at Sun Microsystems in 1991 "The Green Team" Were to investigate "convergence" technologies Gosling created a processor-independent language for '*7', a 2-way
CHAPTER 2 MODELLING FOR DISTRIBUTED NETWORK SYSTEMS: THE CLIENT- SERVER MODEL
CHAPTER 2 MODELLING FOR DISTRIBUTED NETWORK SYSTEMS: THE CLIENT- SERVER MODEL This chapter is to introduce the client-server model and its role in the development of distributed network systems. The chapter
Job Reference Guide. SLAMD Distributed Load Generation Engine. Version 1.8.2
Job Reference Guide SLAMD Distributed Load Generation Engine Version 1.8.2 June 2004 Contents 1. Introduction...3 2. The Utility Jobs...4 3. The LDAP Search Jobs...11 4. The LDAP Authentication Jobs...22
A Survey Study on Monitoring Service for Grid
A Survey Study on Monitoring Service for Grid Erkang You erkyou@indiana.edu ABSTRACT Grid is a distributed system that integrates heterogeneous systems into a single transparent computer, aiming to provide
Experimental Evaluation of Distributed Middleware with a Virtualized Java Environment
Experimental Evaluation of Distributed Middleware with a Virtualized Java Environment Nuno A. Carvalho, João Bordalo, Filipe Campos and José Pereira HASLab / INESC TEC Universidade do Minho MW4SOC 11 December
Instrumentation Software Profiling
Instrumentation Software Profiling Software Profiling Instrumentation of a program so that data related to runtime performance (e.g execution time, memory usage) is gathered for one or more pieces of the
GoToMyPC Corporate Advanced Firewall Support Features
F A C T S H E E T GoToMyPC Corporate Advanced Firewall Support Features Citrix GoToMyPC Corporate features Citrix Online s advanced connectivity technology. We support all of the common firewall and proxy
Multi-Channel Clustered Web Application Servers
THE AMERICAN UNIVERSITY IN CAIRO SCHOOL OF SCIENCES AND ENGINEERING Multi-Channel Clustered Web Application Servers A Masters Thesis Department of Computer Science and Engineering Status Report Seminar
Open source business rules management system
JBoss Enterprise BRMS Open source business rules management system What is it? JBoss Enterprise BRMS is an open source business rules management system that enables easy business policy and rules development,