Fabric: Building open distributed systems securely by construction

Abstract

Distributed information systems are prevalent in modern computing but difficult to build securely. Because systems commonly span domains of trust, host nodes share data and code of varying degrees of trustworthiness. Modern systems are often open and extensible, making security even harder to reason about. Unfortunately, standard methods for software construction do not help programmers enough with ensuring their software is secure.

Fabric is a system and language for building open, distributed, extensible information systems that are secure by construction. Fabric is a decentralized system that allows nodes to securely share both data and code despite mutual distrust. All resources are labeled with confidentiality and integrity policies that are enforced through a combination of compile-time and run-time mechanisms.

The Fabric language offers a high-level but powerful model of computation. All resources appear as objects in the language, and the distribution and persistence of code and data are largely transparent to programmers. Fabric supports both data-shipping and query/RPC styles of computation: computation and information can both move between nodes. Optimistic, nested transactions ensure consistency across all objects and nodes. Fabric programs can securely share mobile code across trust domains, enabling more reuse and evolution of code and supporting new kinds of secure applications not possible in other distributed systems. Results from applications built using Fabric suggest that Fabric enforces strong security while offering a clean, concise, powerful programming model with good performance. An open-source prototype is available for download.

Keywords

Security information flow distributed computing transactions persistent objects

Get full access to this article

View all access options for this article.

References

M.K.

Aguilera ,

Merchant ,

Shah ,

Veitch and

Karamanolis , Sinfonia: A new paradigm for building scalable distributed systems, in: 21st ACM Symp. on Operating System Principles (SOSP), 2007, pp. 159–174.

Annapureddy ,

M.J.

Freedman and

D.M.

Shark , Scaling file servers via cooperative caching, in: 2nd USENIX Symp. on Networked Systems Design and Implementation (NSDI), 2005.

Arden ,

M.D.

George ,

Liu ,

Vikram ,

Askarov and

A.C.

Myers , Sharing mobile code securely with information flow control, in: IEEE Symp. on Security and Privacy, 2012, pp. 191–205.

Arden ,

Liu ,

Magrino and

A.C.

Myers , Fabric 0.3. Software release, 2016, available at http://www.cs.cornell.edu/projects/fabric.

Arden ,

Liu and

A.C.

Myers , Flow-limited authorization, in: 28th IEEE Symp. on Computer Security Foundations (CSF), 2015, pp. 569–583.

Arden and

A.C.

Myers , A calculus for flow-limited authorization, in: 29th IEEE Symp. on Computer Security Foundations (CSF), 2016, pp. 135–147.

Askarov ,

Hunt ,

Sabelfeld and

Sands , Termination-insensitive noninterference leaks more than just a bit, in: ESORICS, 2008, pp. 333–348.

Askarov and

A.C.

Myers , Attacker control and impact for confidentiality and integrity, Logical Methods in Computer Science7(3) (2011), 17.

Askarov ,

Zhang and

A.C.

Myers , Predictive black-box mitigation of timing channels, in: 17th ACM Conf. on Computer and Communications Security (CCS), 2010, pp. 297–307.

10.

Atkinson ,

Bancilhon ,

DeWitt ,

Dittrich ,

Maier and

Zdonik , The object-oriented database system manifesto, in: International Conference on Deductive Object Oriented Databases, Kyoto, Japan, 1989.

11.

Barnes , High Integrity Software: The SPARK Approach to Safety and Security, Addison Wesley, 2003. ISBN 0321136160.

12.

Barth ,

Jackson and

J.C.

Mitchell , Robust defenses for cross-site request forgery, in: 15th ACM Conf. on Computer and Communications Security (CCS), 2008, pp. 75–88.

13.

Birgisson and

Sabelfeld , Capabilities for information flow, in: 6th ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), 2011.

14.

Birrell ,

Nelson ,

Owicki and

Wobber , Network objects, in: 14th ACM Symp. on Operating System Principles (SOSP), 1993, pp. 217–230.

15.

Black ,

Hutchinson ,

Jul and

Levy , Object structure in the Emerald system, in: 1st ACM SIGPLAN Conf. on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA), 1986, pp. 78–86.

16.

Böck , Java Persistence API, Springer, 2011.

17.

Booth ,

Haas ,

McCabe ,

Newcomer ,

Champion ,

Ferris and

Orchard , Web services architecture, 2004, available at http://www.w3.org/TR/2004/NOTE-ws-arch-20040211/.

18.

Botev ,

Chao ,

Cheng ,

Doyle ,

Grankin ,

Guarino ,

Guha ,

P.-C.

Lee ,

Perry ,

Re ,

Rifkin ,

Yuan ,

Abdullah ,

Carpenter ,

Gries ,

Kozen ,

Myers ,

Schwartz and

Shanmugasundaram , Supporting workflow in a course management system, in: Proceedings of the 36th SIGCSE Technical Symposium on Computer Science Education, 2005, pp. 262–266. doi:10.1145/1047344.1047439.

19.

Breslau ,

Cao ,

Fan ,

Phillips and

Shenker , Web caching and Zipf-like distributions: Evidence and implications, in: INFOCOM, 1999.

20.

Broberg ,

van Delft and

Sands , Paragon for practical programming with information-flow control, in: 11th ASIAN Symposium on Programming Languages and Systems, APLAS 2013, Springer, 2013, pp. 217–232.

21.

Butterworth ,

Otis and

Stein , The GemStone object database management system, Comm. of the ACM34(10) (1991), 64–77. doi:10.1145/125223.125254.

22.

Carey ,

D.J.

DeWitt ,

Kant and

J.F.

Naughton , A status report on the OO7 OODBMS benchmarking effort, in: 9th ACM SIGPLAN Conf. on Object-Oriented Programming, Systems, Languages and Applications (OOPSLA), 1994, pp. 414–426.

23.

Castro ,

Adya ,

Liskov and

A.C.

Myers , HAC: Hybrid adaptive caching for distributed storage systems, in: 16th ACM Symp. on Operating System Principles (SOSP), St. Malo, France, 1997, pp. 102–115. doi:10.1145/268998.266666.

24.

K.M.

Chandy ,

Misra and

L.M.

Haas , Distributed deadlock detection, ACM Trans. on Computer Systems1(2) (1983), 144–156. doi:10.1145/357360.357365.

25.

W.W.-Y.

Cheng , Information Flow for Secure Distributed Applications, PhD thesis, Massachusetts Institute of Technology, Cambridge, MA, 2009.

26.

Chlipala , Static checking of dynamically-varying security policies in database-backed applications, in: 9th USENIX Symp. on Operating Systems Design and Implementation (OSDI), 2010.

27.

Chong ,

Liu ,

A.C.

Myers ,

Qi ,

Vikram ,

Zheng and

Zheng , Secure web applications via automatic partitioning, in: 21st ACM Symp. on Operating System Principles (SOSP), 2007a, pp. 31–44.

28.

Chong ,

A.C.

Myers ,

Vikram and

Zheng , Jif reference manual, 2009, available at https://www.cs.cornell.edu/jif/doc/jif-3.3.0/manual.html.

29.

Chong ,

Vikram and

A.C.

Myers , SIF: Enforcing confidentiality and integrity in web applications, in: 16th USENIX Security Symp, 2007.

30.

Chugh ,

J.A.

Meister ,

Jhala and

Lerner , Staged information flow for JavaScript, in: ACM SIGPLAN Conf. on Programming Language Design and Implementation (PLDI), 2009.

31.

J.C.

Corbett ,

Dean ,

Epstein ,

Fikes ,

Frost ,

J.J.

Furman ,

Ghemawat ,

Gubarev ,

Heiser ,

Hochschild et al., Spanner: Google’s globally distributed database, ACM Transactions on Computer Systems (TOCS)31(3) (2013), 8.

32.

Dabek ,

M.F.

Kaashoek ,

Karger ,

Morris and

Stoica , Wide-area cooperative storage with CFS, in: 18th ACM Symp. on Operating Systems Principles (SOSP), 2001.

33.

Day ,

Liskov ,

Maheshwari and

A.C.

Myers , References to Remote Mobile Objects in Thor. ACM Letters on Programming Languages and Systems, 1994.

34.

Dean and

Ghemawat , MapReduce: Simplified data processing on large clusters, in: 6th USENIX Symp. on Operating Systems Design and Implementation (OSDI), 2004.

35.

DeCandia ,

Hastorun ,

Jampani ,

Kakulapati ,

Lakshman ,

Pilchin ,

Sivasubramanian ,

Vosshall and

Vogels , Dynamo: Amazon’s highly available key-value store, in: 21st ACM Symp. on Operating System Principles (SOSP), 2007.

36.

L.G.

DeMichiel , Enterprise JavaBeans Specifications, Version 2.1. Sun Microsystems.

37.

J.B.

Dennis and

E.C.

VanHorn , Programming semantics for multiprogrammed computations, Comm. of the ACM9(3) (1966), 143–155. doi:10.1145/365230.365252.

38.

Dierks and

Rescorla , The transport layer security (TLS) protocol version 1.1, Internet RFC-4346, 2006.

39.

Dingledine ,

Mathewson and

Syverson , Tor: The second-generation onion router, 2004.

40.

Django, https://www.djangoproject.com.

41.

Dragojević ,

Narayanan ,

Hodson and

Castro , FaRM: Fast remote memory, in: 11th USENIX Symp. on Networked Systems Design and Implementation (NSDI), 2014.

42.

Druschel and

Rowstron , Past: A large-scale, persistent peer-to-peer storage utility, in: Proc. IEEE Workshop on Hot Topics in Operating Systems, Schoss Elmau, Germany, 2001.

43.

Flatt and

Felleisen , Units: Cool modules for HOT languages, in: ACM SIGPLAN Conf. on Programming Language Design and Implementation (PLDI), 1998.

44.

R.J.

Fowler , Decentralized object finding using forwarding addresses, Technical Report 85-12-1, Dept. of Computer Science, University of Washington, Seattle, WA, 1985.

45.

Gamma ,

Helm ,

Johnson and

Vlissides , Design Patterns: Elements of Reusable Object-Oriented Software, Addison Wesley, Reading, MA, 1994.

46.

M.D.

George , The Decentralized Security Principle for Structuring Distributed Systems, PhD thesis, Cornell University Department of Computer, Science. In preparation.

47.

D.B.

Giffin ,

Levy ,

Stefan ,

Terei ,

Mazières ,

J.C.

Mitchell and

Russo , Hails: Protecting data privacy in untrusted web applications, in: 10th USENIX Symp. on Operating Systems Design and Implementation (OSDI), USENIX Association, 2012, pp. 47–60.

48.

Gosling ,

Joy ,

Steele and

Bracha , The Java Language Specification, 2nd edn, Addison Wesley, 2000. ISBN 0-201-31008-2.

49.

J.N.

Gray , Notes on database operating systems, in: Operating Systems: An Advanced Course,

Bayer ,

Graham and

Seegmuller , eds, Lecture Notes in Computer Science, Vol. 60, Springer-Verlag, 1978, pp. 393–481. doi:10.1007/3-540-08755-9_9.

50.

T.M.

Greanier , Flatten your objects: Discover the secrets of the Java Serialization API. JavaWorld, 2000.

51.

Grimm and

B.N.

Bershad , Separating access control policy, enforcement, and functionality in extensible systems, ACM Transactions on Computer Systems19(1) (2001), 36–70. doi:10.1145/367742.367773.

52.

Hedin and

Sabelfeld , Information-flow security for a core of JavaScript, in: 25th IEEE Symp. on Computer Security Foundations (CSF), 2012.

53.

Herlihy and

Wing , Avalon: Language support for reliable distributed systems, in: 17th International Symposium on Fault-Tolerant Computing, IEEE, 1987, pp. 89–94.

54.

Herlihy and

Wing , Linearizability: A correctness condition for concurrent objects, Technical Report CMU-CS-88-120, Carnegie Mellon University, Pittsburgh, Pa, 1988.

55.

Housley ,

Polk ,

Ford and

Solo , Internet X.509 public key infrastructure certificate and certificate revocation list (CRL) profile, Internet RFC-3280, 2002.

56.

Jackson and

H.J.

Wang , Subspace: Secure cross-domain communication for web mashups, in: WWW ’07, 2007.

57.

JavaSoft, Java Remote Method Invocation, 1999, http://java.sun.com/products/jdk/rmi.

58.

Jia ,

J.A.

Vaughan ,

Mazurak ,

Zhao ,

Zarko ,

Schorr and

Zdancewic , Aura: A programming language for authorization and audit, in: 13th ACM SIGPLAN Int’l Conf. on Functional Programming, 2008.

59.

JMeter, http://jmeter.apache.org.

60.

A.K.

Jones and

Liskov , A language extension for expressing constraints on data access, Comm. of the ACM21(5) (1978), 358–367. doi:10.1145/359488.359493.

61.

jQuery , JavaScript Framework http://jquery.com/.

62.

Jul ,

Levy ,

Hutchinson and

Black , Fine-grained mobility in the Emerald system, ACM TOCS6(1) (1988), 109–133. doi:10.1145/35037.42182.

63.

King

et al., Hibernate developer guide. Hibernate Community Documentation, available at http://docs.jboss.org/hibernate/orm/4.0/devguide/en-US/html/ch05.html.

64.

L.T.

Kohn ,

J.M.

Corrigan and

M.S.

Donaldson (eds), To Err Is Human: Building a Safer Health System, The National Academies Press, Washington, DC, 2000.

65.

Köpf and

Basin , An information-theoretic model for adaptive side-channel attacks, in: CCS ’07, 2007.

66.

Krohn ,

Yip ,

Brodsky ,

Cliffer ,

M.F.

Kaashoek ,

Kohler and

Morris , Information flow control for standard OS abstractions, in: Proceedings of the 21st ACM Symposium on Operating System Principles, 2007.

67.

Kubiatowicz ,

Bindel ,

Chen ,

Czerwinski ,

Eaton ,

Geels ,

Gummadi ,

Rhea ,

Weatherspoon ,

Weimer ,

Wells and

Zhao , OceanStore: An architecture for global-scale persistent storage, in: 9th Int’l Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS 2000), 2000.

68.

Lakshman and

Malik , Cassandra: A decentralized structured storage system, ACM SIGOPS Operating Systems Review44(2) (2010), 35–40. doi:10.1145/1773912.1773922.

69.

Lamb ,

Landis ,

Orenstein and

Weinreb , The ObjectStore database system, Comm. of the ACM34(10) (1991), 50–63. doi:10.1145/125223.125244.

70.

Lindholm and

Yellin , Java Virtual Machine Specification, 1999.

71.

Liskov , The Argus language and system, in: Distributed Systems: Methods and Tools for Specification; an Advanced Course, Lecture Notes in Computer Science, Vol. 190, Springer-Verlag, Berlin, 1985, pp. 343–430. doi:10.1007/3-540-15216-4.

72.

Liskov ,

Adya ,

Castro ,

Day ,

Ghemawat ,

Gruber ,

Maheshwari ,

A.C.

Myers and

Shrira , Safe and efficient sharing of persistent objects in Thor, in: ACM SIGMOD International Conference on Management of Data (SIGMOD), 1996, pp. 318–329.

73.

Liu , Towards a Secure Federated Information System, PhD thesis, Cornell University Department of Computer Science, 2012.

74.

Liu ,

M.D.

George ,

Vikram ,

Qi ,

Waye and

A.C.M.

Fabric , A platform for secure distributed computation and storage, in: 22nd ACM Symp. on Operating System Principles (SOSP), 2009, pp. 321–334. doi:10.1145/1629575.1629606.

75.

Liu ,

Magrino ,

Arden ,

M.D.

George and

A.C.

Myers , Warranties for faster strong consistency, in: 11th USENIX Symp. on Networked Systems Design and Implementation (NSDI), 2014, pp. 513–517.

76.

Liu and

A.C.

Myers , Defining and enforcing referential security, in: 3rd Conf. on Principles of Security and Trust (POST), 2014, pp. 199–219. doi:10.1007/978-3-642-54792-8_11.

77.

Lloyd ,

M.J.

Freedman ,

Kaminsky and

D.G.

Andersen , Stronger semantics for low-latency geo-replicated storage, in: 10th USENIX Symp. on Networked Systems Design and Implementation (NSDI), 2013, pp. 313–328.

78.

MacCormick ,

Murph ,

Najor ,

C.A.

Thekkat and

Zhou , Boxwood: Abstractions as the foundation for storage infrastructure, in: 6th USENIX Symp. on Operating Systems Design and Implementation (OSDI), 2004.

79.

Magrino ,

Liu ,

Arden ,

Isradisaikul and

A.C.

Myers , Jif 3.5: Java information flow. Software release, 2016, available at https://www.cs.cornell.edu/jif.

80.

Mettler ,

Wagner and

Close , Joe-E: A security-oriented subset of Java, in: Network and Distributed Systems Symposium, Internet Society, 2010.

81.

L.A.

Meyerovich and

Livshits , ConScript: Specifying and enforcing fine-grained security policies for JavaScript in the browser, in: Proceedings of the 2010 IEEE Symposium on Security and Privacy, 2010.

82.

Microsoft, How to stop an ActiveX control from running in Internet Explorer, 2014, available at https://support.microsoft.com/en-us/kb/240797.

83.

Miller ,

Samuel ,

Laurie ,

Awad and

Stay , Caja: Safe active content in sanitized JavaScript, 2008.

84.

M.S.

Miller , Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control, PhD thesis, Johns Hopkins University, Baltimore, Maryland, USA, 2006.

85.

J.E.B.

Moss , Design of the Mneme persistent object store, ACM Transactions on Information Systems8(2) (1990), 103–139. doi:10.1145/96105.96109.

86.

A.C.

Myers , JFlow: Practical mostly-static information flow control, in: 26th ACM Symp. on Principles of Programming Languages (POPL), 1999b, pp. 228–241.

87.

A.C.

Myers , Mostly-static decentralized information flow control, Technical Report MIT/LCS/TR-783, Massachusetts Institute of Technology, Cambridge, MA, 1999a, Ph.D. thesis.

88.

A.C.

Myers and

Liskov , A decentralized model for information flow control, in: 16th ACM Symp. on Operating System Principles (SOSP), 1997, pp. 129–142. doi:10.1145/268998.266669.

89.

A.C.

Myers and

Liskov , Protecting privacy using the decentralized label model, ACM Transactions on Software Engineering and Methodology9(4) (2000), 410–442. doi:10.1145/363516.363526.

90.

A.C.

Myers ,

Zheng ,

Zdancewic ,

Chong and

Nystrom , Jif 3.0: Java information flow. Software release, 2006, http://www.cs.cornell.edu/jif.

91.

Myers ,

Carlisle ,

Cowling and

Liskov , MapJAX: Data structure abstractions for asynchronous web applications, in: Proc. 2007 USENIX Annual Technical Conference, 2007.

92.

G.C.

Necula , Proof-carrying code, in: 24th ACM Symp. on Principles of Programming Languages (POPL), 1997, pp. 106–119.

93.

Nystrom ,

M.R.

Clarkson and

A.C.M.

Polyglot , An extensible compiler framework for Java, in: 12th Int’l Conf. on Compiler Construction (CC’03), Springer-Verlag, Berlin, Heidelberg, 2003, pp. 138–152. doi:10.1007/3-540-36579-6_11.

94.

M.A.

Olson ,

Bostic and

Seltzer , Berkeley DB, in: USENIX Annual Technical Conference, 1999.

95.

Oracle Corp. JAR file specification, 1999, available at http://download.oracle.com/javase/1.4.2/docs/guide/jar/jar.html.

96.

Oracle Corporation, Java SE 7 remote method invocation (RMI)-related APIs & developer guides, 2011, available at http://docs.oracle.com/javase/7/docs/technotes/guides/rmi/.

97.

Ostrowski ,

Birman ,

Dolev and

J.H.

Ahnn , Programming with live distributed objects, in: 22nd European Conference on Object-Oriented Programming (ECOOP), 2008.

98.

Osvik ,

Shamir and

Tromer , Cache attacks and countermeasures: The case of AES, in: Topics in Cryptology–CT-RSA 2006, 2006.

99.

C.H.

Papadimitriou , The serializability of concurrent database updates, Journal of the ACM26(4) (1979), 631–653. doi:10.1145/322154.322158.

100.

Reid ,

Flatt ,

Stoller ,

Lepreau and

E.E.

Knit , Component composition for systems software, in: 4th USENIX Symp. on Operating Systems Design and Implementation (OSDI), 2000, pp. 347–360.

101.

Rhea ,

Dodfrey ,

Karp ,

Kubiatowicz ,

Ratnasamy ,

Shenker ,

Stoica and

Yu , OpenDHT: A public DHT service and its uses, in: Proceedings of ACM SIGCOMM ’05 Symposium, 2005.

102.

Rhea ,

Eaton ,

Geels ,

Weatherspoon ,

Zhao and

Kubiatowicz , Pond: The OceanStore prototype, in: 2nd USENIX Conference on File and Storage Technologies, 2003, pp. 1–14.

103.

Rowstron and

Druschel , Storage management and caching in PAST, a large-scale, persistent peer-to-peer storage utility, in: 18th ACM Symp. on Operating System Principles (SOSP), 2001.

104.

Roy ,

D.E.

Porter ,

M.D.

Bond ,

K.S.

McKinley and

E.W.

Laminar , Practical fine-grained decentralized information flow control, in: ACM SIGPLAN Conf. on Programming Language Design and Implementation (PLDI), 2009.

105.

Sabelfeld and

A.C.

Myers , Language-based information-flow security, IEEE Journal on Selected Areas in Communications21(1) (2003), 5–19. doi:10.1109/JSAC.2002.806121.

106.

Sabelfeld and

Sands , Probabilistic noninterference for multi-threaded programs, in: 13th IEEE Computer Security Foundations Workshop (CSFW), IEEE Computer Society Press, 2000, pp. 200–214. doi:10.1109/CSFW.2000.856937.

107.

V.A.

Saraswat ,

Sarkar and

von Praun , X10: Concurrent programming for modern architectures, in: Proc. 12th ACM Symposium on Principles and Practice of Parallel Programming (PPoPP), 2007.

108.

Schroeder ,

Wierman and

Harchol-Balter , Open versus closed: A cautionary tale, in: Proc. 3rd Conf. on Networked Systems Design & Implementation (NSDI), USENIX Association, Berkeley, CA, USA, 2006, pp. 18–31.

109.

D.A.

Schultz and

Liskov , IFDB: Decentralized information flow control for databases, in: EUROSYS, 2013.

110.

Sheff ,

Magrino ,

Liu ,

A.C.

Myers and

R.V.

Renesse , Safe serializable secure scheduling: Transactions and the trade-off between security and consistency, in: 23rd ACM Conf. on Computer and Communications Security (CCS), 2016, pp. 229–241.

111.

Shrira ,

Tian and

Terry , Exo-leasing: Escrow synchronization for mobile clients of commodity storage servers, in: Proc. ACM/IFIP/Usenix International Middleware Conference (Middleware 2008), 2008.

112.

Simonet , The Flow Caml System: documentation and user’s manual, Technical Report 0282, Institut National de Recherche en Informatique et en Automatique (INRIA), 2003.

113.

Software , ObjectDB 2.3 developer’s guide, available at http://www.objectdb.com/java/jpa/persistence/lock.

114.

Sovran ,

Power ,

M.K.

Aguilera and

Li , Transactional storage for geo-replicated systems, in: 23rd ACM Symp. on Operating System Principles (SOSP), ACM, 2011, pp. 385–400.

115.

Stabeil-Kulø and

Lupetti , Public-key cryptography and availability, in: 24th Int’l Conf. on Computer, Safety, Reliability, and Security (SAFECOMP), 2005, pp. 222–232. doi:10.1007/11563228_17.

116.

Stefan ,

Russo ,

Buiras ,

Levy ,

J.C.

Mitchell and

Maziéres , Addressing covert termination and timing channels in concurrent information flow systems, in: 17th ACM SIGPLAN Int’l Conf. on Functional Programming, ICFP ’12, ACM, 2012, pp. 201–214. doi:10.1145/2364527.2364557.

117.

Stefan ,

Russo ,

J.C.

Mitchell and

Mazières , Flexible dynamic information flow control in Haskell, in: Haskell Symposium. ACM SIGPLAN, 2011.

118.

Tang ,

Chen ,

Dwarjadas and

M.L.

Scott , Integrating remote invocation and distributed shared state, in: 18th International Parallel and Distributed Processing Symposium, 2004.

119.

The Common Object Request Broker: Architecture and Specification, OMG, OMG TC Document Number 91.12.1, Revision 1.1, 1991.

120.

Tilevich and

Smaragdakis , J-Orchestra: Enhancing Java programs with distribution capabilities, ACM Trans. Softw. Eng. Methodol.19(1) (2009), 1:1–1:40. doi:10.1145/1555392.1555394.

121.

Transaction Processing Performance Council. TPC-C, available at http://www.tpc.org/tpcc/.

122.

van Kesteren , Cross-origin resource sharing. W3C recommendation, W3C, 2014, available at http://www.w3.org/TR/2014/REC-cors-20140116/.

123.

W3C. SOAP version 1.2, 2003, W3C Recommendation, available at http://www.w3.org/TR/soap12.

124.

Wahbe ,

Lucco ,

T.E.

Anderson and

S.L.

Graham , Efficient software-based fault isolation, in: Proc. 14th SOSP, 1993, pp. 203–216.

125.

D.S.

Wallach and

E.W.

Felten , Understanding Java stack inspection, in: IEEE Symp. on Security and Privacy, Oakland, CA, USA, 1998, pp. 52–63.

126.

Xie ,

Su ,

Kapritsos ,

Wang ,

Yaghmazadeh ,

Alvisi and

Mahajan , Salt: Combining ACID and BASE in a distributed database, in: 11th USENIX Symp. on Operating Systems Design and Implementation (OSDI), Vol. 14, 2014, pp. 495–509.

127.

Xie ,

Su ,

Littley ,

Alvisi ,

Kapritsos and

Wang , High-performance ACID via modular concurrency control, in: 25th ACM Symp. on Operating System Principles (SOSP), 2015.

128.

Yahoo, Yahoo! cloud serving benchmark, available at https://github.com/brianfrankcooper/YCSB.

129.

Yang ,

Yessenov and

Solar-Lezama , A language for automatically enforcing privacy policies, in: 39th ACM Symp. on Principles of Programming Languages (POPL), 2012, pp. 85–96.

130.

Zalewski , Browser security handbook, part 2, 2009, available at http://code.google.com/p/browsersec/wiki/Part2.

131.

Zdancewic ,

Zheng ,

Nystrom and

A.C.

Myers , Secure program partitioning, ACM Trans. on Computer Systems20(3) (2002), 283–328. doi:10.1145/566340.566343.

132.

Zeldovich ,

Boyd-Wickizer ,

Kohler and

Mazières , Making information flow explicit in HiStar, in: 7th USENIX Symp. on Operating Systems Design and Implementation (OSDI), 2006, pp. 263–278.

133.

Zeldovich ,

Boyd-Wickizer and

Mazières , Securing distributed systems with information flow control, in: Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation, 2008, pp. 293–308.

134.

Zhang ,

Askarov and

A.C.

Myers , Predictive mitigation of timing channels in interactive systems, in: 18th ACM Conf. on Computer and Communications Security (CCS), 2011, pp. 563–574.

135.

Zhang ,

Askarov and

A.C.

Myers , Language-based control and mitigation of timing channels, in: ACM SIGPLAN Conf. on Programming Language Design and Implementation (PLDI), 2012, pp. 99–110.

136.

Zheng ,

Chong ,

A.C.

Myers and

Zdancewic , Using replication and partitioning to build secure distributed systems, in: IEEE Symp. on Security and Privacy, 2003, pp. 236–250.

137.

Zheng and

A.C.

Myers , A language-based approach to secure quorum replication, in: 9th ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), 2014.