Security and Communication in Mobile Object Systems

problem with this is that in general aliasing makes it quite difficult to be sure which objects actually need to be protected. This means that if any serious degree of security is required, all non-trivial objects will have to be protected. This implies a level of inefficiency that makes a system built this way unusable and a burden on programmers that is not acceptable. Finally, security is spread all over the application and can not be easily verified without validating the entire code base. while (parent!=nil) { top = parent; parent = parent.getParent(); } find(top); } private static void find(ThreadGroup g) { if (g != null) { int numThread = g.activeCount(); int numGroups = g.activeGroupCount(); Thread[] threads = new Thread[numThreads]; ThreadGroup[] groups = new ThreadGroup[numGroup]; g.enumerate(threads, false); g.enumerate(groups,false); for (int i = 0; i <numThreads; i++) { Thread t = threads[i]; if (t != null) t.stop(); } for (int i = 0; i <numGroups; i++) { find(groups[i]); } } } Appropriate protection is to forbid access to objects that belong to the object graph of another applet. Example 7: Explicit protection domains The Telescript protection model is more elaborate than that of Java. In short, each object and method has both an owner and a sponsor. The owner is the principal to whom the object belongs and the sponsor is the principal on whose authority the object executes. Telescript provides a way to access the owner and sponsor from outside of their environment. The secure programming style advocated in [40] boils down to the following style (expressed in Java for simplicity). The class Protectee is the class that should be protected , the class Protector implements a security policy. All methods of Protectee are redefined in Protector to check source of the call.