Hisashi Kojima
Fujitsu Laboratories Limited
Japan

Ikuya Morikawa
Fujitsu Laboratories Limited
Japan

Yuko Nakayama
Fujitsu Laboratories Limited
Japan

Yuji Yamaoka
Fujitsu Laboratories Limited
Japan

We have developed a mechanism which prevents abuse of trusted Java applets, such as digitally signed applets. A signed applet is usually permitted to perform some dangerous actions by a user. However, an attacker may improperly recompose the signed applet with malicious components and harm the user by abusing such dangerous actions of the signed applet. In this paper, we call this a malicious recomposition attack and propose an innovative mechanism to solve the problem of such attack. Before deployment, a target signed applet is encapsulated into a special signed applet cozilet in an indecomposable format. On its execution, the cozilet isolates the classes and resources of the encapsulated applet by assigning a special class loader unique to the applet. It also enforces applet-document binding so that it is never executed from untrusted HTML documents. The mechanism is easily applicable to target signed applets because it is transparent not only to target applets, but also to current Java VM implementations. Therefore, the mechanism can easily protect both applets developed in the future and the applets currently in use. We call this mechanism Cozilet and have implemented it for Sun Java VM. In this paper, we describe its basic mechanism and implementation details.

Keywords: Java applet, signed applet, mobile code, abuse, encapsulation, transparency

Read Paper (in PDF)