Francois Rouaix. A web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, pages 1365--1371, Paris, France, May 1996.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....compiled with profiling enabled and one without. However, once dynamically bound, a variable s definition is fixed, precluding rebinding for marshalling or update. Modern languages often provide an interface to the dynamic linker so that programs can load new code at run time [DE, dlo, L 01, Rou96, AVWW96] Dynamic linking has been formally modelled for low level machine code [Dug00, HWC00, 33 5.3 Dynamic Update 6 CONCLUSIONS AND FUTURE WORK HW00] and high level languages like Java [DE] Several authors have considered customised linking for security, performance, or debugging purposes ....

....AVWW96] Dynamic linking has been formally modelled for low level machine code [Dug00, HWC00, 33 5. 3 Dynamic Update 6 CONCLUSIONS AND FUTURE WORK HW00] and high level languages like Java [DE] Several authors have considered customised linking for security, performance, or debugging purposes [Rou96, SNC00, HWC00, SV00] Rebinding in Distributed Calculi A number of distributed process calculi provide implicit rebinding of names, adopting interaction primitives with meanings that depend on where they are used in a location structure [CG98, SV00, RH99, Sch02, SWP99, CS00] This allows a form ....

Francois Rouaix. A Web navigator with applets in Caml. In Proc. 5th World Wide Web Conference, pages 1365--1371, 1996.

.... garbage collector, which we have extended for distributed collection; and low level access to the system, with many Unix system calls (POSIX threads, sockets, Indeed, OCaml has been used to develop many complex programs for distributed systems, such as Web browsers with applets (MMM [26]) group communication libraries (Ensemble [12] and Active Networks (SwitchWare [2] and to experiment on a variety of parallel machines. Adding Concurrent Programming. OCaml is a sequential language: expressions are evaluated in call by value, in a deterministic manner. As a rst language ....

F. Rouaix. A web navigator with applets in caml. In Fifth WWW Conference, Paris, May 1996.

....other languages which meet the requirements listed and alien could have been implemented in most if not all of them. Nonetheless, there were some factors which inclined us toward Caml and away from some other languages. Obviously, the hashes can be trivially forged to attack this system. Rouaix [10] suggests using a well known, certi ed compiler which digitally signs its output. A veri er such as is used in Java [11] would be another approach to this problem. Java [11] has been a popular language for implementing active networking systems. While Java meets our requirements, meeting our ....

F. Rouaix. A web navigator with applets in Caml. Fifth WWW Conf., May 1996.

....to a heterogeneous collection of processors and executed with identical semantics on each processor [ATLLW96] 7 . mobile code, an approach where programs are considered as documents, and should therefore be accessible, transmitted and displayed (i.e. evaluated) as any other document [Rou96]; mobile code is software that travels on a heterogeneous network, crossing protection domains, and is automatically executed upon arrival at the destination [Tho97] Mobile code has given rise to new programming paradigms [CGPV97, CPV97] other than the traditional client server one: ....

F. Rouaix. A Web navigator with applets in CAML. Computer Networks and ISDN Systems, 28(7-11):1365--1371, 1996.

.... unchanged to a heterogeneous collection of processors and executed with identical semantics on each processor [20] mobile code, an approach where programs are considered as documents, and should therefore be accessible, transmitted and displayed (i.e. evaluated) as any other document [21]; mobile code is software that travels on a heterogeneous network, crossing protection domains, and is automatically executed upon arrival at the destination [4] Mobile code has given rise to new programming paradigms [3, 22] other than the traditional client server one: Remote ....

F. Rouaix. A Web navigator with applets in CAML. Computer Networks and ISDN Systems, 28(7-11):1365-1371, 1996.

.... PCC Touchstone system, for example, dynamic linking has only been performed in an ad hoc manner, entirely within the TCB [35] and the current Java to PCC compiler, Special J, does not support dynamic linking [6] Most general purpose languages support dynamic linking [3] 9] 13] 27] 36] [37], so if we are to compile such languages to PCC, then it must provide some support for implementing dynamic linking. We believe this support should meet three important criteria: 1. Security. It should only minimally expand the TCB, improving confidence in the system s security. Furthermore, ....

....of DLopen has performance comparable to the standard ELF implementation [40] and has the added benefit of safety. Furthermore, we can program many other dynamic linking approaches within our framework, including Java classloaders [23] Windows DLLs and COM [7] Objective Caml s Dynlink [27] [37], Flatt and Felleisen s Units [13] and SPIN s domains [38] among others. The remainder of this paper is organized as follows. In the next section we motivate and present our framework, which we call TAL Load. In Section 3 we describe a type safe version of DLopen programmed using TAL Load. In ....

[Article contains additional citation context not shown here]

F. Rouaix. A Web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, in Computer Networks and Telecommunications Networking, volume 28, pages 1365--1371. Elsevier, May 1996.

....and is therefore the most general, validating our claim of TAL Load s flexibility. This claim is further bolstered in Section 6.4. 2 where we explain how we might have programmed other approaches, including Java classloaders [jav96] Windows DLL s and COM [com01] Objective Caml s Dynlink [Ler00, Rou96] Flatt and Felleisen s Units [FF98] and SPIN s domains [SFPB96] among others. We begin by describing DLpop and the ways in which it di#ers from DLopen, and then follow with a description of our implementation written in TAL Load. 6.1 DLpop: A Type safe DLopen Most Unix systems provide some ....

....addition to the GUID of the expected interface, ensuring the proper type of the returned interface. Objective Caml Modules OCaml provides dynamic linking for its bytecode based runtime system with a special Dynlink module; these facilities have been used to implement an OCaml applet system, MMM [Rou96] Dynlink essentially implements dlopen, but not dlsym and dlclose, and would thus be easy to encode in TAL Load. In contrast to the JVM, OCaml does not verify that its extensions are well formed, and instead relies on a trusted compiler. OCaml dynamic linking is similar to that of other ....

[Article contains additional citation context not shown here]

Francois Rouaix. A Web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, in Computer Networks and Telecommunications Networking, volume 28, pages 1365--1371. Elsevier, May 1996.

....requires repeated checks at runtime 5 . These semantic restrictions depend on the integrity of other system components such as the operating system, shared libraries, etc. The semantic restrictions are enforced with a strongly typed language which supports garbage collection and module thinning [26]. ALIEN [27] 17] is one of the systems built within the SwitchWare project. ALIEN provides the ability to build prototype active networking systems based both active packets and active extensions. Active code is written the Caml language. For SANE, we have extended ALIEN to make use of the ....

F. Rouaix, "A web navigator with applets in Caml," Fifth WWW Conf., May 1996. Available at http://pauillac.inria.fr/mmm/papers/mmm.ps.gz.

....property like type safety or program invariants. A signature is attached to the mobile 20 code unit only when the corresponding formal property is found in the unit. The attachment of signature can result from three possibilities: 1. Code is trusted because it is generated by a trusted compiler [94, 78]. 2. Code is trusted because it has been properly rewritten by a trusted program transformer [102] 3. Code is trusted because it has been certified by a trusted program analyzer [35] A program analytic semantics may be more reliable than informal endorsement, because we are now trusting a ....

Francois Rouaix. A web navigator with applets in Caml. In Proceedings of the 5th WWW Conference, Paris, May 1996. Also available at http://pauillac.inria.fr/ ~rouaix/ mmm/ papers/ mmm.ps.gz.

....the language ML. We chose Caml based on our own background as ML programmers and because of very positive experiences with Caml as a language for writing distributed and network programs. In particular, our own active network implementation [17] and projects elsewhere such as Ensemble [9] and MMM [20] have shown that Caml can be used to build efficient distributed applications quickly. This success is supported by language features such as strong typing and automatic memory management. Another good candidate would have been Java, which also offers these features, but the Caml compiler and ....

Francois Rouaix. A web navigator with applets in Caml. In Fifth WWW Conference, 1996.

....the Linux operating system for low level services such as raw Ethernet sockets. Much of the software is available from the SwitchWare Web site, http: www.cis.upenn.edu switchware. The ALIEN system restricts access to system services using a namespace restriction scheme called module thinning [Rou96] the basic idea being that if the program cannot access certain facilities, it cannot misuse them. 1 We define system integrity to mean that the system is not altered from some known (and presumably correct) state. 6.2 SANE Details The Secure Active Network Environment (SANE) AAKS98] is an ....

Francois Rouaix. A web navigator with applets in Caml. Fifth WWW Conference, May 1996. http://pauillac.inria.fr-/mmm/papers/mmm.ps.gz.

....to a heterogeneous collection of processors and executed with identical semantics on each processor [ATLLW96] ffl . mobile code, an approach where programs are considered as documents, and should therefore be accessible, transmitted and displayed (i.e. evaluated) as any other document [Rou96b] ffl Mobile agents are code containing objects that may be transimitted between communicating participants in a distributed system [Kna96] In this survey we will refer to mobile code as software that travels on a heterogeneous network, crossing protection domains, and is automatically executed ....

....to implement dynamic loading. 4.3 Objective Caml Objective Caml (O Caml) Ler97] is a functional language in the ML tradition, originating from Caml, a language developed at Inria that is widely used in education. O Caml has been used as a language for mobile code in the development of the MMM [Rou96b, Rou96a] web browser, also developed at Inria. MMM adds the possibility of dynamically linking and executing O Caml applets accessed through the web. MMM provides a number of hooks for the applets, for example applets can add elements to the user menu, include new content decoders, or change the ....

F. Rouaix. A web navigator with applets in Caml. In Proceedings of the Fifth International World-Wide Web Conference, Paris, France, May 1996. Elsevier Science B. V.

....memory accesses. These are common in unsafe language such as C. To enforce the policy, the code of computation must be safe, code which may be either in source form, bytecode, or native object form. Code can be guaranteed safe if it is signed by a trusted party (as in the MMM Caml web browser [34]) if it carries its own proof of correctness (e.g. PCC [30] if the language is safe and the bytecode can be verified to adhere to the high level language semantics (e.g. Java) if the code executes in a highly restricted environment and is not allowed to emit illegal instructions (e.g. Agent ....

F. Rouaix. A Web navigator with applets in Caml. In Fifth WWW Conference, Paris, France, May 1996.

....convinced that the code supplied by an untrusted code producer has some (previously agreed upon) set of properties. Sometimes this is referred to as establishing trust between the consumer and producer. Cryptography can be used to ensure that the code was produced by a trusted person or compiler [1, 19]. This scheme is weak because of its dependency on personal authority even trusted persons, or compilers written by them, can occasionally make errors. We propose a mechanism that allows the code consumer to define a safety policy and then verify that this policy is respected by native code ....

Rouaix, F. A Web navigator with applets in Caml. Proceedings of the 5th International World Wide Web Conference, in Computer Networks and Telecommunications Networking 28, 7--11 (May 1996), 1365--1371.

....convinced that the code supplied by an untrusted code producer has some (previously agreed upon) set of properties. Sometimes this is referred to as establishing trust between the consumer and producer. Cryptography can be used to ensure that the code was produced by a trusted person or compiler [1, 13]. This scheme is weak because of its dependency on personal authority even trusted persons, or compilers written by them, can make errors occasionally or even act maliciously. In this paper, we present proof carrying code (PCC for short) which is a mechanism for dealing with these problems. ....

Rouaix, F. A Web navigator with applets in Caml. Proceedings of the 5th International World Wide Web Conference, in Computer Networks and Telecommunications Networking 28, 7--11 (May 1996), 1365--1371.

.... What, exactly, makes strongly typed applets more secure than untyped ones Most frameworks proposed so far for safe local execution of foreign code rely on strong typing, either statically checked at the client side [19, 44] statically checked at the server side and cryptographically signed [35], or dynamically checked by the client [8] However, the main property guaranteed by strong typing is type soundness: well typed programs do not go wrong , e.g. do not apply an integer as if it were a function. While violations of type soundness constitute real security threats (casting a ....

....though it is unclear how much is guaranteed. Subtype polymorphism in systems such as F : 11] also provide some amount of type abstraction, but this is not so in Java because the actual type of an object can be tested at run time (downcasts) 7 Application: safety in the MMM browser MMM [35] is a Web browser with applets developed by the second author. MMM ensures safe execution of applets using various techniques similar in spirit to those formulated earlier in this paper. Essentially identical techniques are now used in the SwitchWare project at U. Penn [4, 5] an active network ....

[Article contains additional citation context not shown here]

F. Rouaix. A Web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, Computer Networks and Telecommunications Networking, volume 28, pages 1365--1371. Elsevier, May 1996.

.... What, exactly, makes strongly typed applets more secure than untyped ones Most frameworks proposed so far for safe local execution of foreign code rely on strong typing, either statically checked at the client side [19, 44] statically checked at the server side and cryptographically signed [35], or dynamically checked by the client [8] However, the main property guaranteed by strong typing is type soundness: well typed programs do not go wrong , e.g. do not apply an integer as if it were a function. While violations of type soundness constitute real security threats (casting a ....

....though it is unclear how much is guaranteed. Subtype polymorphism in systems such as F : 11] also provide some amount of type abstraction, but this is not so in Java because the actual type of an object can be tested at run time (downcasts) 7 Application: safety in the MMM browser MMM [35] is a Web browser with applets developed by the second author. MMM ensures safe execution of applets using various techniques similar in spirit to those formulated earlier in this paper. Essentially identical techniques are now used in the SwitchWare project at U. Penn [4, 5] an active network ....

[Article contains additional citation context not shown here]

F. Rouaix. A Web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, Computer Networks and Telecommunications Networking, volume 28, pages 1365-1371. Elsevier, May 1996.

No context found.

Francois Rouaix. A web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, pages 1365--1371, Paris, France, May 1996.

No context found.

F. Rouaix. A Web navigator with applets in Caml. In Proceedings of the 5th International World Wide Web Conference, in Computer Networks and Telecommunications Networking, volume 28:7--11, pages 1365--1371. Elsevier, May 1996.

No context found.

F. Rouaix. A web navigator with applets in Caml. In Proceedings of the Fifth International World-Wide Web Conference, Paris, France, May 1996. Elsevier Science B. V.

No context found.

Francois Rouaix. A Web navigator with applets in Caml. In Proc. 5th World Wide Web Conference, pages 1365--1371, 1996.

No context found.

F. Rouaix. A web navigator with applets in caml. In Fifth WWW Conference, Paris, May 1996.

No context found.

F. Rouaix, "A web navigator with applets in caml," in Proc. 5th Int. World Wide Web Conf. Compater Networks Telecommunications Networking, vol. 28, May 1996, pp. 1365--1371.

No context found.

F. Rouaix, "A Web navigator with applets in Caml", Computer Networks and ISDN Systems, vol. 28, pp. 1365-1371, 1996.

No context found.

F. Rouaix. A Web navigator with applets in Caml. In Proc. 5th World Wide Web Conference, pages 1365--1371, 1996.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC