A secure OSGi environment for untrusted web applications
Timo Aho, Johannes Koskinen, Antti Nieminen · 2013
For some time it has been a growing trend to move applications from the desktop to the web and especially to cloud environment. Very often the web application solutions are based on the Java language. In this case, the OSGi specification is arguably the number one choice for running multiple applications on a single Java virtual machine. Unfortunately, OSGi does not solve all the security vulnerabilities that emerge in such an environment. For instance, computer resource usage is only marginally controlled. In this paper, we discuss the security of the OSGi environment. In particular, we introduce a solution to running untrusted OSGi applications. In our case, controlling the permissions of the applications is fairly simple. A more challenging task is to manage the computer resource usage. We present a moderately straightforward solution that still grants a reasonable level of security. Unlike other similar OSGi resource managers and monitors, our solution does not need any modifications to the web applications or OSGi components. Moreover, we distinguish each web session of an application while competing methods only monitor complete applications as single entities.