An abstract class loader for the SSP and its implementation in TL.

Abstract

The SSP is a hardware implementation of a subset of the JVM for use in high consequence embedded applications. In this context, a majority of the activities belonging to class loading, as it is defined in the specification of the JVM, can be performed statically. Static class loading has the net result of dramatically simplifying the design of the SSP as well as increasing its performance. Due to the high consequence nature of its applications, strong evidence must be provided that all aspects of the SSP have been implemented correctly. This includes the class loader. This article explores the possibility of formally verifying a class loader for the SSP implemented in the strategic programming language TL. Specifically, an implementation of the core activities of an abstract class loader is presented and its verification in ACL2 is considered.

Trusted Computing Technologies, Intel Trusted Execution Technology.

“…Both the hardware and class loader were tested rigorously by different teams using various techniques to ensure correctness. Further publications discuss more details of the class loader [Wickstrom et al, 2004b, Winter et al, 2005. The SSP's stated purpose (embedded computing) does not match this paper's stated problem (protecting sensitive inputs, computations, and outputs on commodity hardware, software, and networks).…”