Spout: A Transparent Distributed Execution Engine for Java Applets

The advent of executable contents such as Java applets exposes WWW users to a new class of attacks that were not possible before. Despite an array of security checking, detection , and enforcement mechanisms built into the language model, the compiler, and the run-time system of Java, serious security breach incidents due to implementation bugs have been reported in the past several years. Without a provably correct implementation of Java's security speciication, it is diicult to make any conclusive statements about the security characteristic of current Java systems. The Spout project takes an alternative approach to address Java's security problems. Rather than attempt a prov-ably secure implementation, we aim to connne the damages of malicious Java applets to selective machines, thus preventing the machines behind an organization's rewall from being attacked by malicious or buggy applets. More concretely, Spout is a distributed Java execution engine that transparently decouples the processing of an incoming ap-plet's application logic from that of graphical use interface (GUI), such that the only part of an applet that is actually running on the requesting user's host is the harmless GUI code. A unique feature of the Spout architecture is that it is completely transparent to and does not require any modiications to WWW browsers or class libraries on the end hosts. This paper describes the detailed design, implementation, and performance measurements of the rst Spout prototype, which also incorporates run-time resource monitoring mechanisms to defeat denial-of-service attacks.