SHF: Small: Multi-Version eXecution for Managed Languages

SHF：小型：托管语言的多版本执行

• 批准号: 2227183
• 负责人: Luís Gabriel Ganchinho de Pina
• 金额: $ 54.07万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-07-01 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2227183&HistoricalAwards=false
• 关键词: SHF; Small; Multi; Version; eXecution

Multi-Version eXecution (MVX) allows to run multiple versions of the same program (variants) at the same time. MVX has direct applications in the broad areas of reliability (many variants can tolerate one variant crashing), security (a vulnerability exploited on one variant can be detected by the other variants), and availability (one can perform a software update on one variant while other variants keep executing). Unfortunately, current MVX cannot be applied to programs written in managed languages, which make up the vast majority of the programs used today. This project expands the applicability of MVX to managed languages, thus making MVX applicable to the majority of programs used nowadays. The project’s novelties are: (i) tools and techniques to apply MVX to popular managed languages and programs written in them, such as Java, Javascript, and Python; (ii) a direct application to apply MVX inside state-of-the-art commercial internet browsers via the Javascript code that animates and defines web pages; and (iii) tools and techniques to retrofit existing programs with MVX support with minimal developer support. The project's impacts are: to use MVX to improve the overall reliability, security, and availability of software written in managed languages, which includes critical infrastructure and modern internet browsers that millions of users in the US use every day.Current MVX techniques capture the interaction of a program with the underlying Operating System. Such approaches fail for managed languages, as managed languages have a rich runtime system with a non-deterministic behavior not directly related with the program being executed (e.g., when to perform Garbage Collection, when to perform Just-In-Time compilation, and what code to compile/optimize). In this project, the research team captures the interaction between the program and the language runtime, which effectively lifts the level of abstraction of MVX and enables novel solutions for well known limitations of MVX (e.g., multi-threading support, divergence handling). The presented approach relies on semantics-preserving automatic program transformations to enable MVX, and this project is divided in three thrusts. The first thrust focuses on JavaScript as executed inside commercial internet browsers. The second thrust focuses on Java and similar languages (e.g., C#, Python), by identifying language-level abstractions to capture via bytecode instrumentation and developing novel techniques to support MVX for multi-threaded programs. Finally, the third thrust focuses on automatic techniques that allow to execute divergent variants (e.g., two versions of the same program).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

多版本扩展（MVX）允许同时运行同一程序的多个版本（变体）。MVX在可靠性（许多变体可以容忍一个变体崩溃），安全性（在一个变体上利用的漏洞可以被其他变体检测到）和可用性（可以在一个变体上执行软件更新，而其他变体继续执行）的广泛领域中具有直接应用。不幸的是，当前的MVX不能应用于用托管语言编写的程序，而托管语言构成了当今使用的绝大多数程序。该项目将MVX的适用性扩展到托管语言，从而使MVX适用于当今使用的大多数程序。该项目的创新之处是：（i）将MVX应用于流行的托管语言和用它们编写的程序的工具和技术，例如Java，JavaScript和Python;（ii）通过动画和定义网页的JavaScript代码在最先进的商业互联网浏览器内应用MVX的直接应用程序;以及（iii）在最小的开发人员支持下利用MVX支持改造现有程序的工具和技术。该项目的影响是：使用MVX来提高以托管语言编写的软件的整体可靠性、安全性和可用性，其中包括美国数百万用户每天使用的关键基础设施和现代互联网浏览器。当前的MVX技术捕获程序与底层操作系统的交互。这样的方法对于受管语言失败，因为受管语言具有丰富的运行时系统，该运行时系统具有与正被执行的程序不直接相关的非确定性行为（例如，何时执行垃圾收集，何时执行即时编译，以及编译/优化什么代码）。在这个项目中，研究团队捕获了程序和语言运行时之间的交互，这有效地提升了MVX的抽象级别，并为MVX的众所周知的限制提供了新的解决方案（例如，多线程支持、发散处理）。所提出的方法依赖于语义保持自动程序转换，使MVX，这个项目分为三个推力。第一个重点是在商业互联网浏览器中执行的JavaScript。第二个重点是Java和类似的语言（例如，C#，Python），通过识别通过字节码插装捕获的语言级抽象，并开发新的技术来支持多线程程序的MVX。最后，第三个重点是自动技术，允许执行不同的变体（例如，该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。