Link-Time Enforcement of Confined Types for JVMBytecode

Abstract Confined types enforce a form of encapsulation stronger than what the standard Java typesystem offers. It is known that confined types effectively prevent accidental reference leaks that could lead to security breaches in object-oriented programs. Because existing formulationsof confined types target the Java source language, they can only be enforced by the code producer at compile time. As such these formulations fail to qualify as practical language-based protection mechanisms for the Java platform. This paper presents a capability-based formulation of confined types for JVM bytecode,and reports the first implementation to enforce confined types at link time, on the code consumer side. This novel formulation of confined types is backward compatible, modular, andinteroperable with lazy dynamic linking. The paper also demonstrates how this bytecode-level formulation of confined types can be applied to facilitate a form of secure cooperation betweenmutually suspicious code units. 1 Introduction Security is an essential attribute of dependable systems. The Java platform, a language envi-ronment designed with security in mind, has been considered to be a platform of choice for developing and deploying networked and extensible software systems with demanding secu-rity requirements. At the core of the Java security infrastructure is a strong type system, which provides non-bypassable encapsulation boundaries for controlling access to privileged ser-vices and sensitive data. To appreciate the pivotal role of type soundness and encapsulation in the Java security enterprise, one only needs to recall that the soundness of the Java type systemguarantees that no type confusion will occur, and thus the security manager will be properly encapsulated, and consequently the rest of the Java protection infrastructure can function asdesigned