Citation Context

...nly person hurt in either case is the clientin question. Consequently, Xen provides a more general solution: there is no need for hosted code to be digitally signed by a trusted compiler (as in SPIN =-=[5]-=-), to be accompanied by a safety proof (as with PCC [31]), to be written in a particular language (as in SafetyNet [22] or any Java-based system), or to rely on a particular middleware (as with mobile...

Citation Context

...ven worse in practice, because the kinds of properties required of the application code are di cult in the sense that standard type systems cannot express them easily. For example, in the SPIN kernel =-=[1]-=-, there are often basic requirements about the proper use of synchronization locks that would be hard, if not impossible, to express in the ML or Modula-3 type systems.In the situations described abo...

Citation Context

...ts. The advantages of downloading code are that potentially expensive crossings can be avoided and that this code can run without requiring the application itself to be scheduled. Type-safe languages =-=[9, 42]-=-, interpretation, and sandboxing [52] can be used to execute untrusted application code safely [21]. We provide examples of each of these three techniques below and discuss how secure bindings apply t...

Citation Context

... allows us to reap the benets of types throughout a compiler, but it also enables a practical system for executing untrusted code safely and eciently. For example, as suggested by the SPIN project [=-=Bershad et al. 1995-=-], operating systems could allow users to download TAL extensions into the kernel. The kernel would type check the TAL extension, thereby ensuring that it never accesses hidden resources within the ke...

Citation Context

.... A number of systems have attempted to remedy this problem by exposing more control to applications. Scheduler activations [5], application-specific handlers [59], and operating systems such as SPIN =-=[11]-=-, Exokernel [28], and Nemesis [34] are all attempts to augment limited operating system interfaces by giving applications the ability to specialize the policy decisions made by the kernel. However, th...

Citation Context

...ardware memory protection and restricting their access to sensitive interfaces. A wide variety of systems have addressed this problem, from exotic microkernel [42, 45] and safe language based systems =-=[11]-=- to practical adaptations to existing operating systems, such as Nooks, which provides device driver isolation for fault tolerance in Linux [56]. A further threat that must be addressed is posed by ma...

Citation Context

...roving extensibility and reliability through the use of new kernel architectures [15], new driver architectures [38], user-level extensions [18, 31, 55], new hardware [16, 54], or type-safe languages =-=[3]-=-. While many of the underlying techniques used in Nooks have been used in previous systems, Nooks differs from earlier efforts in two key ways. First, we target existing extensions for commodity opera...

Citation Context

...,71] and isolation kernels [69], the use of small hypervisors as a minimal trust base [16,26,56,59], as well as systems that require the use of type-safe languages for all code except some“dirty”core =-=[7,23]-=-. Similarly, the Common Criteria [66] at the strictest evaluation level requires the system under evaluation to have a “simple” design. With truly small kernels it becomes possible to take security an...