| 摘要 |
A computer architecture providing enhanced JVM security and a method of providing enhanced security for a JVM are disclosed. The host computer runs a single, first, trusted JAVA API library above which is located a hypervisor software layer, and then at least one untrusted JAVA API library. The code of each second, upper, untrusted JAVA API library is modified at, or before runtime to call the hypervisor software layer instead of the JVM to thereby create a silo corresponding to each of the second, upper, untrusted JAVA API libraries. Each silo extends between the host computer and the corresponding second, upper, untrusted JAVA API library. The hypervisor software layer is operated to only permit communication between each of the second, upper, untrusted JAVA API libraries and a corresponding portion of the memory and functional assets of the host computer. Consequently, each of the second, upper, untrusted JAVA API libraries cannot communicate with all of the host computer memory and/or all of the host computer functional assets. A computer program product is also disclosed. |
