The goal of the Lana project is to develop system support for short-distance wireless applications. We chose a language-based approach: mechanisms like scoping and typing are used to enforce system properties. The Lana language is strongly influenced by Java-it contains interfaces, packages, single inheritance etc.-though is designed with support for disconnected operation, coordination and security. Lana supports concurrent programs. The language semantics states that all memory locations transitively reachable from a program object must be moved along with the program. Further, the set of programs is organized into a hierarchy. When a program moves between nodes then all of its sibling programs are moved along with it. This feature is used by applications to specify hoarding policies: all related programs and objects are grouped under a common umbrella program which is moved. Method calls between programs are asynchronous; thus, a caller is never blocked awaiting a reply that might never come. Each method call generates a unique key object that is used by a program to locate the reply message or exception if ever the program momentarily leaves the network. Return messages-or security or mobility exceptions provoked by the call-have this key value bound to them. Any program that is delegated the key by the caller may therefore service the reply message. Thus a node may leave a network yet safely delegate its pending jobs to other nodes.

It is essential for security to be able to isolate mistrusting programs from one another, and to protect the host platform from programs. Isolation is difficult in object-oriented systems because objects can easily become aliased. Aliases that cross program boundaries can allow programs to exchange information without using a system provided interface that could control information exchange. In Java, mistrusting programs are placed in distinct loader spaces but uncontrolled sharing of system classes can still lead to aliases between programs. This paper presents the object spaces protection model for an object-oriented system. The model decomposes an application into a set of spaces, and each object is assigned to one space. All method calls between objects in different spaces are mediated by a security policy. An implementation of the model in Java is presented.

This paper addresses the problem of resolving virtual method and interface calls in Java bytecode. The main focus is on a new practical technique that can be used to analyze large applications. Our fundamental design goal was to develop a technique that can be solved with only one iteration, and thus scales linearly with the size of the program, while at the same time providing more accurate results than two popular existing linear techniques, class hierarchy analysis and rapid type analysis.We present two variations of our new technique, variable-type analysis and a coarser-grain version called declared-type analysis. Both of these analyses are inexpensive, easy to implement, and our experimental results show that they scale linearly in the size of the program.We have implemented our new analyses using the Soot frame-work, and we report on empirical results for seven benchmarks. We have used our techniques to build accurate call graphs for complete applications (including libraries) and we show that compared to a conservative call graph built using class hierarchy analysis, our new variable-type analysis can remove a significant number of nodes (methods) and call edges. Further, our results show that we can improve upon the compression obtained using rapid type analysis.We also provide dynamic measurements of monomorphic call sites, focusing on the benchmark code excluding libraries. We demonstrate that when considering only the benchmark code, both rapid type analysis and our new declared-type analysis do not add much precision over class hierarchy analysis. However, our finer-grained variable-type analysis does resolve significantly more call sites, particularly for programs with more complex uses of objects.