多线程Java程序安全行为模型的静态检查方法

Static Checking of Security Related Behavior Model for Multithreaded Java Programs

多线程作为支持程序结构化和并行化的重要机制,其应用越来越广泛,多线程应用程序的安全性也成为新的研究热点之一.针对Java多线程程序,文中采用参数化扩展上下文无关文法作为其安全相关行为模型的抽象表示,给出了从多线程Java程序自动生成安全相关行为模型的方法,形式地描述了静态检查该模型是否满足安全策略的实现,并应用到携带模型代码方法的实现框架中.该方法为安全执行非信任多线程Java移动代码提供了有效支持.

Multithreading is an important mechanism for supporting program structuring and parallel computation. With the wide usage of multithreading, security for multithreaded application has become one of new hot research topics. This paper focuses on the security of Java multithreaded programs. At first, parameterized extended context free grammar has been used to formally represent security related behavior model for multithreaded Java program; then the way of automatic generation of such model is introduced, and an approach to statically check security related behavior model is formalized. The method has been applied in the framework of model carrying code. It has been indicated that the method provides effective support for safe execution of untrusted multithreaded Java mobile code.