Michael L. Powell

Subcontract: a flexible base for distributed programming

A key problem in operating systems is permitting the orderly introduction of new properties and new implementation techniques. We describe a mechanism, subcontract, that within the context of an object-oriented distributed system permits application programmers control over fundamental object mechanisms. This allows programmers to define new object communication mechanisms without modifying the base system. We describe how new subcontracts can be introduced as alternative communication mechanisms in the place of existing subcontracts. We also briefly describe some of the uses we have made of the subcontract mechanism to support caching, crash recovery, and replication.

An overview of the Spring system

Spring is a highly modular, distributed, object-oriented operating system. This paper describes the goals of the Spring system and provides overviews of the Spring object model, the security model, and the naming architecture. Implementation details of the Spring microkernel, virtual memory system, file system, and UNIX emulation are supplied.<<ETX>>

Persistence in the Spring system

The Spring system does not provide persistent object identifiers and not all Spring objects are persistent. Instead, we rely on a general name service and persistent name-to-object bindings to support persistence. The name service is separate from the various subsystems that implement persistent objects, so that new object types can be added, and the implementation of existing types can be changed, without rebuilding the name service. We distinguish among the concepts of freezing, pickling, and externalizing. We then develop a general framework for freezing that can be used by any client, including the name server,for making objects persistent. It allows subsystems that implement objects of various types to maintain autonomy from the name service and retain control over how their objects are implemented and made persistent, and yet be well integrated with the name service.<<ETX>>

Security in the Spring name service

Spring provides a uniform name service for an open ended collection of object types-in principle, any object, of any type, can be bound to any name. The name service implements authentication and access control to protect itself, and provides these same functions in an integrated way for the convenience of clients and the object managers that implement the various objects in the system. An object manager can delegate these functions to the name service, or implement its own policies. The name service is implemented as a collection of name servers which are generally autonomous and separate from each other and also from object managers. The architecture allows trusted and untrusted name servers and object managers to participate in providing naming and in publishing objects. Authentication is done at appropriate times to establish trust. These trust relationships are encoded in capability-like authenticated objects which are reused to avoid authentication complexity and overhead after trust is established.<<ETX>>