10.17863/CAM.10495
Chisnall, David
Davis, Brooks
Gudka, Khilan
Brazdil, David
Joannou, Alexandre
Woodruff, Jonathan
Markettos, Athanasios
Maste, J Edward
Norton, Robert
Son, Stacey
Roe, Michael
Moore, Simon
0000-0002-2806-495X
Neumann, Peter G
Laurie, Ben
Watson, Robert
CHERI JNI: Sinking the Java Security Model into the C
Apollo - University of Cambridge Repository (staging)
2017
Apollo - University of Cambridge Repository (staging)
Apollo - University of Cambridge Repository (staging)
2017-11-24
2017-11-24
2017-06
Conference Object
0163-5980
https://www.repository.cam.ac.uk/handle/1810/269668
1943-586X
Java provides security and robustness by building a high- level security model atop the foundation of memory protection. Unfortunately, any native code linked into a Java program – including the million lines used to implement the standard library – is able to bypass both the memory protection and the higher-level policies. We present a hardware-assisted implementation of the Java native code interface, which extends the guarantees required for Java’s security model to native code. Our design supports safe direct access to buffers owned by the JVM, including hardware-enforced read-only access where appropriate. We also present Java language syntax to declaratively describe isolated compartments for native code. We show that it is possible to preserve the memory safety and isolation requirements of the Java security model in C code, allowing native code to run in the same process as Java code with the same impact on security as running equivalent Java code. Our approach has a negligible impact on performance, compared with the existing unsafe native code interface. We demonstrate a prototype implementation running on the CHERI microprocessor synthesized in FPGA.
Defense Advanced Research Projects Agency Google, Inc. Isaac Newton Trust Thales E-Security
Engineering and Physical Sciences Research Council
EP/K008528/1
EPSRC
EP/K503757/1