Secure Execution of Java Applets using a Remote Playground

摘要

Mobile code presents a number of threats to machines that execute it. Weintroduce an approach for protecting machines and the resources they hold frommobile code, and describe a system based on our approach for protecting hostmachines from Java 1.1 applets. In our approach, each Java applet downloaded tothe protected domain is rerouted to a dedicated machine (or set of machines),the {\em playground}, at which it is executed. Prior to execution the applet istransformed to use the downloading user's web browser as a graphics terminalfor its input and output, and so the user has the illusion that the applet isrunning on her own machine. In reality, however, mobile code runs only in thesanitized environment of the playground, where user files cannot be mounted andfrom which only limited network connections are accepted by machines in theprotected domain. Our playground thus provides a second level of defenseagainst mobile code that circumvents language-based defenses. The paperpresents the design and implementation of a playground for Java 1.1 applets,and discusses extensions of it for other forms of mobile code including Java1.2.