Inférence de certificats pour la vérification statique des programmes Java

Authors: Menif, Emna
Advisor: Debbabi, MouradTawbi, Nadia
Abstract: Information Systems Security is one of the most pressing challenges facing all kind of organizations today. The security problem has raised from rapid technological advances that are stimulating a greater use of \emph{Information Systems} in world-wide organizations. One of these advances is the use of mobile code. Keeping critical information safe from malicious mobile code is challenging. One way to address the security issue for mobile code is using certifying compilation. The certifying compilation is a language-based, static technique used to collect information (certificate) regarding the safety and security of a software. In addition to the advantages of the static analysis, this approach alleviates the burden on the consumer. The other advantage of this approach is to restrict the trust of the consumer to the verifier only. In this thesis we have applied this approach to Java to check safety and security statically. As we know, Java is present in a wide range of devices, computers, and networks due to it's versatility, efficiency, platform portability and security . Nevertheless, high-level security properties are verified by bytecode verifier and security manager at run time. The main objectives of this thesis are the design and the implementation of a Java certifying compiler (JACC) that helps to increase the flexibility, efficiency and robustness of the Java security architecture. Indeed, JACC certificate is verified statically by the JACC verifier to ensure high-level security properties. The certificate is made up of annotations that try to capture the behavior of a software and represent it in an abstract form. This behavior could be critical and aims to threaten the software user. The main research contributions that led to reach these objectives are: \begin{enumerate} \item the definition of the certificate syntax and semantic; \item the design and the implementation of JACC based on Jikes. We have also measured the generated \emph{.class} files sizes and JACC performance and compared them to Jikes; \item the elaboration of a formal framework in which we formally specify the certificate inference. This specification describes the operational semantic of each inference step as long as a type system for the certificate annotations. \end{enumerate}
Document Type: Thèse de doctorat
Issue Date: 2012
Open Access Date: 18 April 2018
Grantor: Université Laval
Collection:Thèses et mémoires

Files in this item:
28119.pdf2.17 MBAdobe PDFView/Open
All documents in CorpusUL are protected by Copyright Act of Canada.