Pilot: An Operating System for a Personal Computer

Redell, David D.; Dalal, Yogen K.; Horsley, Thomas R.; Lauer, Hugh C.; Lynch, William C.; McJones, Paul; Murray, Hal; Purcell, S.

doi:10.1007/978-1-4757-3510-9_20

Cited by 11 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, the operating system Pilot [9] used a safe language [6] in a single address space to provide security without a kernel. Various approaches of software-based protection has recently been reconsidered in the context of Java [12].…”

Section: Related Workmentioning

confidence: 99%

Experience with secure multi-processing in Java

Balfanz

Gong

Proceedings. 18th International Conference on Distributed Computing Systems (Cat. No.98CB36183)

View full text Add to dashboard Cite

As Java is the preferred platform for the deployment of network computers, it is appealing to run multiple applications on a single Java desktop. We experimented with using the Java platform as a multi-processing, multiuser environment. Although the Java Virtual Machine (JVM) is not inherently a single-application design, we have found that the implementation of the Java Development Kit (JDK) often implicitly assumes that the Java Virtual Machine runs exactly one application at any one time.In this paper, we report the limitations we encountered and propose improvements to several aspects of the Java architecture, including its security features. We have implemented all the proposed changes in a prototype based on the in-house beta version of JDK 1.2. Our prototype uses a Bourne shell-like command line tool to launch multiple applications (such as Appletviewer) within one JVM.

show abstract

Section: Related Workmentioning

confidence: 99%

Experience with secure multi-processing in Java

Balfanz

Gong

Proceedings. 18th International Conference on Distributed Computing Systems (Cat. No.98CB36183)

View full text Add to dashboard Cite

show abstract

“…None of them, however, provides strong resource controls. Pilot [30] and Cedar [36] were two of the earliest language-based systems. Their development at Xerox PARC predates a flurry of research in the 1990's on such systems.…”

Section: Extensible Operating Systemsmentioning

confidence: 99%

Processes in KaffeOS: Isolation, Resource Management, and Sharing in Java

Back¹,

Hsieh²,

Lepreau³

2000

View full text Add to dashboard Cite

Single-language runtime systems, in the form of Java virtual machines, are widely deployed platforms for executing untrusted mobile code. These runtimes provide some of the features that operating systems provide: inter-application memory protection and basic system services. They do not, however, provide the ability to isolate applications from each other, or limit their resource consumption. This paper describes KaffeOS, a system that provides these features for a Java runtime. The KaffeOS architecture takes many lessons from operating system design, such as the use of a user/kernel boundary.The KaffeOS architecture supports the OS abstraction of a process in a Java virtual machine. Each process executes as if it were run in its own virtual machine, including separate garbage collection of its own heap. The difficulty in designing KaffeOS lay in balancing the goals of isolation and resource management against the goal of allowing direct sharing. Overall, KaffeOS is up to 11% slower than the freely available JVM on which it is based, which is an acceptable penalty for the safety that it provides. KaffeOS is substantially slower than commercial JVMs, but exhibits much better performance scaling in the presence of uncooperative code.

show abstract

“…It employs both static and run-time measures to avoid operations that are potentially harmful. Systems that use safe languages for system extensions include Pilot [70], which runs programs written in Mesa, HotJava Web Browser, which can be extended with applets written in Java, and the SPIN extensible OS [7], which can be extended with modules written in Modula 3.…”

Section: Hybrid Techniquesmentioning

confidence: 99%

“…The first trend is dynamic extensibility, where a trusted host is extended by importing and executing untrusted foreign code. For example, web browsers download plug-ins [65,83]; databases load type-specific extensions for storing and querying unconventional data [40,82]; operating systems load customized policies, general functionality [7,26,55,66,70,75,80,85], and performance-measurement code [85]. Operating systems can download part of an application into the kernel so that the application can perform better.…”

Section: Introductionmentioning

confidence: 99%

Safety checking of machine code

Miller

Reps

2000

SIGPLAN Not.

View full text Add to dashboard Cite

Importing and executing untrusted foreign code has become an everyday occurrence: Web servers download plug-ins and applets; databases load type-specific extensions; and operating systems load customized policies and performance measurement code. Certification of the safety of the untrusted code is crucial in these domains.I have developed new methods to determine statically whether it is safe for untrusted machine code to be loaded into a trusted host system. My safety-checking technique operates directly on the untrusted machine-code program, requiring only that the initial inputs to the untrusted program be annotated with typestate information and linear constraints. This approach opens up the possibility of being able to certify code produced by any compiler from any source language. It eliminates the dependence of safety on the correctness of the compiler because the final product of the compiler is checked. It leads to the decoupling of the safety policy from the language in which the untrusted code is written, and consequently, makes it possible for safety checking to be performed with respect to an extensible set of safety properties that are specified on the host side.I have implemented a prototype safety checker for SPARC machine-language programs, and applied the safety checker to examples (ranging from code that contains just a few branches, to code that contains nested loops, and to code that contains function and method calls). The safety checker was able to mechanically synthesize the loop invariants and check these examples in times ranging from less than a second to dozens of seconds.

show abstract

Pilot: An Operating System for a Personal Computer

Cited by 11 publications

References 10 publications

Experience with secure multi-processing in Java

Experience with secure multi-processing in Java

Processes in KaffeOS: Isolation, Resource Management, and Sharing in Java

Safety checking of machine code

Contact Info

Product

Resources

About