Decentralized Information Flow Control on a Bare-Metal JVM

摘要

Hybrid DIFC systems allow effective implementation of DIFC across all layers of the software stack. Implementing DIFC on a BMJVM has the benefits of not having to modify and audit OS code. Implementing DIFC on a meta-circular BMJVM allows us to write all the components in Java. Having filesystem and networking code implemented in Java allows uniform DIFC monitoring for both program data structures and OS resources. The trusted code base is completely within the DIFC enabled Guest VM, we argue that this facilitates easier audit and maintenance in comparison to a traditional hybrid DIFC system.