Security benchmarks of OSGi platforms: Toward Hardened OSGi

Software - Practice and Experience

Volumn 39, Issue 5, 2009, Pages 471-499

  Parrend, P ^a   Frenot, S ^b  

^a FZI RESEARCH CENTER FOR INFORMATION TECHNOLOGY   (Germany)

^b UNIVERSITÉ DE LYON   (France)

Author keywords

Component platform; Dependability; OSGi component framework; Security benchmark; Software security assurance; Software vulnerabilities

Indexed keywords

COMPONENT PLATFORM; DEPENDABILITY; OSGI COMPONENT FRAMEWORK; SECURITY BENCHMARK; SOFTWARE SECURITY ASSURANCE; SOFTWARE VULNERABILITIES;

EID: 65349177152     PISSN: 00380644     EISSN: 1097024X     Source Type: Journal    
DOI: 10.1002/spe.906     Document Type: Article

References (39)

1. JSR 118 Expert Group, MIDP 2.0', Sun Specification. 2002.
2. OSGI Alliance. OSGi Service Platform, Core Specification Release 4.1, Draft, 2007.
3. Parrend P, Frenot S. Supporting the secure deployment of OSGi Bundles. First IEEE WoWMoM Workshop on Adaptive and DependAble Mission-and bUsiness-Critical Mobile Systems, Helsinki, Finland, 2007.
4. Bieber G, Carpenter J. Introduction to Service-Oriented Programming (Rev 2.1), OpenWings Whitepaper, 2001.
5. Howes T. The String Representation of LDAP Search Filters. IETF RFC, Network Working Group, Request for Comments: 2254, 1997.
6. OSGi Alliance, Hall RS. 'Bundle Repository', OSGi Alliance RFC 112, 2006.
7. Sun Microsystems, Inc. JAR File Specification, Sun Java Specifications, 2003.
8. Lindholm T, Yellin F. The Java(TM) Virtual Machine Specification (2nd edn). Prentice-Hall PTR: Englewood Cliffs, NJ, 1999.
9. Saraswat V. Java is not type-safe, AT&T Research Whitepaper, 1997.
10. Drossopoulou S, Eisenbach S. Java is type safe-Probably. ECOOP'97-Object-Oriented Programming. Springer: Berlin/Heidelberg, 1997; 389-418.
11. Jensen T, Metayer DL, Thorn T. Security and dynamic class loading in Java: A formalisation. IEEE International Conference on Computer Languages, Chicago, IL, U.S.A., 1998; 4-15.
12. Dean D, Felten EW, Wallach DS. Java Security: From HotJava to Netscape and beyond. SP'96: Proceedings of the 1996 IEEE Symposium on Security and Privacy. IEEE Computer Society: Washington, DC, U.S.A., 1996; 190.
13. Gong L, Ellison G, Dadgeforde M. Inside Java 2 Platform Security-Architecture, API Design, and Implementation (2nd edn). Addison-Wesley: Reading, MA, 2003.
14. Gong L, Mueller M, Prafullchandra H, Schemers R. Going beyond the sandbox: An overview of the new security architecture in the Java development Kit 1.2. Proceedings of the USENIX Symposium on Internet Technologies and Systems, Monterey, CA, U.S.A., 1997.
15. Bryce C. Isolates: A new approach to multi-programming in Java Platforms, May 2004, LogOn Technology Transfer OT Land. Available at: http://www.bitser. net/isolate-interest/papers/bryce-05.04.pdf.
16. Czajkowski G, Daynes L, Titzer B. A multi-user Virtual Machine. Usenix, 2003; 85-98.
17. Czajkowski G, Hahn S, Skinner G, Soper P, Bryce C. A resource management interface for the Java Platform, SMLI TR-2003-124, May 2003.
18. Aslam T. A taxonomy of security faults in the Unix operating system. Master's Thesis, Purdue University, 1995; 120.
19. Bloch J. Effective Java Programming Language Guide. Addison-Wesley Professional: Reading, MA, 2001.
20. Bloch J, Gafter N. Java Puzzlers-Traps, Pitfalls and Corner Cases, Pearson Education. Addison-Wesley: Reading, MA, 2005.
21. Cotroneo D, Orlando S, Russo S. Failures classification and analysis of the Java Virtual Machine. Twenty-sixth IEEE International Conference on Distributed Computing Systems (ICDCS'06), Lisboa, Portugal, 2006.
22. OSGi Alliance. RFC 18: Security Architecture Specification, OSGi Alliance Request for Comment, 2001.
23. Huang C-C, Wang P-L, Hou T-W. Advanced OSGi Security Layer. AINAW '07: Proceedings of the 21st International Conference on Advanced Information Networking and Applications Workshops, vol. 2, Niagara Falls, Canada, 2007; 518-523.
24. Sun Microsystems, Inc. JavaTM Virtual Machine Profiler Interface (JVMPI). JavaTM 2 Platform Standard Edition 5.0-Overview. Available at: http://java.sun.com/j2se/1.5.0/docs/guide/jvmpi/, 2004.
25. Sun Microsystems, Inc. JVMTM Tool Interface (JVM TI). JavaTM 2 Platform Standard Edition 5.0-Overview. Available at: http://java.sun.com/ j2se/1.5.0/docs/guide/jvmti/, 2004.
26. Gamma E, Helm R, Johnson R, Vlissides J. Design Patterns: Elements of Reusable Object-Oriented Software. Addison-Wesley: Reading, MA, 1994.
27. Schumacher M. Security Engineering with Patterns. Springer: Berlin, 2003.
28. Arvidsson J, Cormack A, Demchenko Y, Meijer J. TERENA's incident object description and exchange format requirements, IETF RFC 3067, 2001.
29. EISPP Consortium. EISPP Common Advisory Format Description, EISPP Whitepaper EISPP-D3-001-TR, 2003.
30. Martin RA. Transformational vulnerability management through standards, CrossTalk. The Journal of Defense Software Engineering 2005; 12-15.
31. Mowbray TJ, Malveau RC. Corba Design Patterns. Wiley: New York, 1997.
32. Necula GC. Proof-carrying code. Conference Record of POPL '97: The 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, Paris, France, 1997; 106-119.
33. Parrend P, Frenot S. Java Components Vulnerabilities-An experimental classification targeted at the OSGi Platform'(RR-6231). Technical Report INRIA, 2007; 84.
34. Black PE. Software assurance metrics and tool evaluation. Proceedings of the 2005 International Conference on Software Engineering Research and Practice (SERP'05), Las Vegas, NV, U.S.A., 2005.
35. Neumann PG, Parker DB. A summary of computer misuse techniques. Proceedings of the 12th National Computer Security Conference, 1989; 396-406.
36. Lindqvist U, Jonsson E. How to systematically classify computer security intrusions. IEEE Symposium on Security and Privacy, Oakland, CA, U.S.A., 1997; 154-163.
37. Arnold TF. The concept of coverage and its effect on the reliability model of a repairable system. IEEE Transactions on Computers 1973; 22:251-254.
38. Howard M, Pincus J, Wing J. Computer Security in the 21st Century. Measuring Relative Attack Surfaces. Springer: New York, 2005; 109-137.
39. Mikkonen T. Programming Mobile Devices: An Introduction for Practitioners. Wiley: New York, 2007; 244.