A secure OSGi environment for untrusted web applications

  • Authors:
  • Timo Aho;Johannes Koskinen;Antti Nieminen

  • Affiliations:
  • Tampere University of Technology, Tampere, Finland;Tampere University of Technology, Tampere, Finland;Tampere University of Technology, Tampere, Finland

  • Venue:
  • Proceedings of the Second Nordic Symposium on Cloud Computing & Internet Technologies
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

For some time it has been a growing trend to move applications from the desktop to the web and especially to cloud environment. Very often the web application solutions are based on the Java language. In this case, the OSGi specification is arguably the number one choice for running multiple applications on a single Java virtual machine. Unfortunately, OSGi does not solve all the security vulnerabilities that emerge in such an environment. For instance, computer resource usage is only marginally controlled. In this paper, we discuss the security of the OSGi environment. In particular, we introduce a solution to running untrusted OSGi applications. In our case, controlling the permissions of the applications is fairly simple. A more challenging task is to manage the computer resource usage. We present a moderately straightforward solution that still grants a reasonable level of security. Unlike other similar OSGi resource managers and monitors, our solution does not need any modifications to the web applications or OSGi components. Moreover, we distinguish each web session of an application while competing methods only monitor complete applications as single entities.