: dvips paper.dvi ':: job starts

Abstract A single address space operating system is an excellent environment for the im-plementation of distributed object-based systems. The issue of providing effective and efficient protection of objects in such an environment has, however, not beenaddressed satisfactorily. This paper presents the protection mechanism of Mungi1, which is based on password capabilities. A system-maintained data structure calledthe capability tree is used for the long-term storage of capabilities, and reflects the hierarchical structure of object privacy. A second system data structure, the activeprotection domain, allows the system to find capabilities quickly when validating memory accesses. The model supports inheritance of protection domains, as wellas temporary extension of protection domains to support privileged procedures. Untrusted programs can be confined to run in a restricted protection domain. Theprotection system performs efficiently on conventional architectures, and is simple enough that most programs do not need to be aware of its operation. 1 Introduction In the past it has been difficult to allow sharing in a distributed environment due to thedifficulties of implementing a global object naming scheme [1]. As we have pointed out earlier [2], a clean and elegant solution to this dilemma is to provide an all-encompassingsingle address-space, which contains the virtual memory of all processes on all nodes in a distributed computing system. Such a global virtual memory system (GVMS) isprovides a persistent object store. The recent advent of 64-bit microprocessors (MIPS \Lambd