Visualization of Permission Checks in Java Using Static Analysis
Visualization of Permission Checks in Java Using Static Analysis
复制标题
使用静态分析在 Java 中可视化权限检查
DOI：
10.1007/978-3-540-71093-6_11
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
Byeong
中科院分区：
文献类型：
--
作者：
Yoonkyung Kim;Byeong
Java 2中的安全管理器是一种运行时访问控制机制。每当请求对关键资源的访问权限时，安全管理器检查调用堆栈以检查程序是否具有适当的访问权限。这个称为堆栈检查的运行时权限检查强制执行访问控制策略，将访问权限与发起访问的类关联起来。在本文中，我们开发了一个可视化工具，帮助程序员执行安全策略有效地到程序。它基于静态权限检查分析，静态权限检查分析近似于静态权限检查，每个方法必须成功或失败。使用可视化系统，程序员可以在必要时修改程序和策略文件，因为他们可以检查权限检查及其堆栈检查是如何执行的。这个过程可以重复，直到安全策略被正确地实施。
The security manager in Java 2 is a runtime access control mechanism. Whenever an access permission to critical resources is requested, the security manager inspects a call stack to examine whether the program has appropriate access permissions or not. This run-time permission check calledstack inspectionenforces access-control policies that associate access rights with the class that initiates the access. In this paper, we develop a visualization tool which helps programmers enforce security policy effectively into programs. It is based on the static permission check analysis which approximates permission checks statically which must succeed or fail at each method. Using the visualization system, programmers can modify programs and policy files if necessary, as they examine how permission checks and their stack inspection are performed. This process can be repeated until the security policy is enforced correctly.