OSGi Release 4 [10] . The publication process is not defined by these specifications, but relies on the Open Bundle The OSGi platform is a lightweight management layer Repository (OBR) format [11], which is supported by sevover a Java virtual machine that makes runtime extensieral Open Source OSGi implementations: the OBRI format bility and multi-application support possible in mobile and is supported by Oscar and Knopflerfish, and the OBR2 forconstraint environments. This powerfull capability opens mat is supported by Felix. a particular attack vector against mobile platforms: the in- The OSGi platform is a lightweight overlay to the Java stallation ofmalicious OSGi bundles. Thefirst countermeavirtual machine, which supports the runtime installation of sure is the digital signature of the bundles. We developed a Java components, the management of their life-cycle, as tool suite that supports the signature, the publication and well as the proper expression of the dependencies between the validation of the bundles in an OSGi framework. Our them. This facility typically allows a user to discover softtools support the publication of bundles onto a remote bunware packages that are available on the Internet or in its dle repository as well as the validation of the signature acnear environment, to install them together with their depencording to the OSGi R4 specifications. A comparison of exdencies, and to un-install them when they are no longer reisting validation mechanisms shows that our security layer quired. The runtime extensibility which is thus provided is the only one that is compliant with the specification. opens a new attack vector, which to the best of our knowledge has been overlooked in the literature: the possibility of seamlessly executing malicious code from the environ-1 Introduction ment. Figure 1 shows the attack tree for executing malicious
Parrend et al. REF developed a toolsuite that supports the whole OSGi signature standard as well as deployment of bundles.
Supporting the Secure Deployment of OSGi Bundles
2007 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks
2007 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks
Computer Science