SKR 5302: Advanced Distributed Computing

5.3. Protection

• Protect from illegitimate accesses for resources.
• Threats may come from maliciously contrived code. 
• Example:
  • Consider a file – two operations: read and write
  • Ensure that each of the file’s two operations can be performed only by clients with the right to perform it. 
  • Example: Smith: read and right, Jones: read.
  • Illegitimate access – Jones managed to perform a write operation on the file. 
  • A complete solution in a distributed system requires cryptographic techniques. 
• Threats may also come from misbehaving client sidesteps the operation that a resource exports. 
  • Example: Smith or Jones managed to execute an operation that was neither read nor write. 
  • Smith managed to access the file pointer directly and construct a setFilePointerRandomly operation, that sets the file pointer to a random number.

• To protect resources from illegitimate invocations: use type-safe programming language such as Sing# (extension of C#) or Modula-3. 

• In type-safe languages, no module may access a target module unless it has a reference to it – it cannot make up a pointer to it. 
• Employ hardware support to protect modules from one another at the level of individual invocations, regardless of the language in which they are written – kernel.
• Kernels and protection
  • The kernel is a program that is remains loaded from system initialization 
  • Its code is executed with complete access privileges for the physical resources on its host computer. 
  • It can control memory management unit and set the processor registers so that no other code may access the machine’s physical resources except in acceptable ways. 
• Kernels and protection
• A kernel process executes with the processor in supervisor (privileged) mode.
• The kernel arranges that other processes execute in user (unprivileged) mode. 
• The kernel sets up address spaces to protect itself and other processes from the accesses of an aberrant process.
• Address space – a collection of ranges of virtual memory locations with memory access rights applies such as read-only or read-write. 
• A process cannot access memory outside its address space. 
• The kernel provide processes with their required virtual memory layout. 
• When a process executed application code, it executes in a distinct user-level address space for that application.
• When the same process executes kernel code, it executes in the kernel’s address space. 
• The process can safely transfer from a user-level address space to the kernel’s address space via an operation such as an interrupt or a system call trap. 
• Example of interrupt or a system call trap execution
  • Implemented by a machine-level TRAP instruction.
  • Puts the processor into supervisor mode and switches to the kernel address space. 
  • The hardware forces the processor to execute a kernel-supplied handler function, in order that no process may gain illicit control of the hardware. 
• However, switching between address spaces may take many processor cycles, and a system call trap is a more expensive operation than a simple procedure or method call.