INSTITUTE OFAERONAUTICAL ENGINEERING

(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
DEADLOCKS
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
System model: Deadlock characterization

• In a computer system a deadlock is where two or more

processes are unable to proceed because each process
is waiting for the other to release a resource that it
needs to continue execution.

• In other words, a deadlock occurs when two or more

processes are in a circular wait state, and none of them
can release the resources they hold until they receive
the resources they are waiting for.
System model: Deadlock characterization

• Circular Wait
• A process is waiting for the resource held by the second process,
which is waiting for the resource held by the third process and so
on, till the last process is waiting for a resource held by the first
process. This forms a circular chain. For example: Process 1 is
allocated Resource2 and it is requesting Resource 1. Similarly,
Process 2 is allocated Resource 1 and it is requesting Resource 2.
This forms a circular wait loop.
System model: Deadlock characterization

• A Deadlock is a situation where each of the computer

process waits for a resource which is being assigned to
some another process.

• In this situation, none of the process gets executed since

the resource it needs, is held by some other process
which is also waiting for some other resource to be
released.
System model: Deadlock characterization

• Deadlock System Model −

• The Deadlock System model is a way to describe and
analyze systems that may be prone to deadlocks, which
occur when two or more processes are unable to proceed
because they are each waiting for the other to release a
resource.

• Below are the components of this model −

• Resources − The system has a set of resources that are
shared among processes. These resources can be
hardware or software components, such as memory, files,
printers, or network connections. Each resource is
identified by a unique name or identifier.
System model: Deadlock characterization

•Processes − The system has a set of processes that request

and release resources. Processes are units of execution that
can be started, suspended, resumed, and terminated. Each
process is identified by a unique process ID.

•Resource Allocation − Each resource can be in one of two

states , allocated or available. A resource that is allocated to
a process cannot be used by any other process until it is
released.
System model: Deadlock characterization

•Request and Release − A process can request a resource by

sending a request to the system. If the resource is available,
it will be allocated to the process. When a process is finished
using a resource, it must release it so that it can be used by
other processes.

•Resource Dependency − Some processes may require

multiple resources to complete their tasks. A resource
dependency graph can be used to represent the
relationships between processes and resources and to detect
potential deadlocks.
System model: Deadlock characterization

•Deadlock Detection − A deadlock can occur when two or

more processes are waiting for resources that are being held
by other processes, creating a circular dependency. Deadlock
detection algorithms can be used to detect when a deadlock
has occurred, so that corrective action can be taken.

•Deadlock Resolution − Once a deadlock has been detected,

it can be resolved by breaking the circular dependency
between the processes. This can be done by releasing one or
more resources that are being held by a process, or by
preempting one or more processes that are holding
resources.
System model: Deadlock characterization

•The Working of some of the techniques are given below −

• Resource preemption is a technique used to break the
circular wait condition of a deadlock.

• The operating system can preempt resources from one

or more processes involved in the deadlock and allocate
them to the processes that need them.

• Preemption can be done either selectively or globally.

In selective preemption, only the resources that are
required to resolve the deadlock are preempted, while
in global preemption, all the resources held by the
deadlocked processes are preempted.
System model: Deadlock characterization

•When a process is terminated, all the resources held by the

process are released, and other processes can proceed.
However, this approach can lead to data loss and
inconsistency if the terminated process was in the middle of
a critical task.

•Deadlock Avoidance − Deadlock avoidance is a technique

used to prevent the occurrence of deadlocks in a computer
system. The goal of deadlock avoidance is to ensure that all
resources required by a process are available before the
process starts execution, thereby avoiding the possibility of
deadlock.
System model: Deadlock characterization

There are several algorithms that can be used for deadlock

avoidance, including the banker's algorithm and the resource
allocation graph. These algorithms use a mathematical
model to analyze resource allocation and to determine
whether a process should be allowed to start or wait for
resources.
•The banker's algorithm is a widely used method for
deadlock avoidance. It is a resource allocation algorithm that
checks whether a requested resource can be granted to a
process without causing a deadlock. The algorithm works by
simulating the allocation of resources and checking whether
a safe state can be reached. A safe state is a state where all
processes can complete their execution without causing a
deadlock.
System model: Deadlock characterization

• The resource allocation graph is another method for

deadlock avoidance. It represents the allocation of
resources as a directed graph.

• Each process is represented by a node, and each resource

is represented by an edge.

• The algorithm checks for cycles in the graph to determine

whether a deadlock has occurred. If a cycle is detected,
the process requesting the resource is blocked until the
required resource becomes available.
System model: Deadlock characterization

• In summary, the deadlock system model is a crucial idea

in the design and management of operating systems. It
outlines the potential causes of deadlocks as well as
strategies for avoiding and resolving them.

• It is crucial to put into practice efficient prevention

measures for deadlocks since they might result in
substantial performance degradation and data loss.
System model: Deadlock characterization

• A deadlock occurs if the four conditions hold true. But

these conditions are not mutually exclusive. They are
given as follows −

Mutual Exclusion
There should be a resource that can only be held by one
process at a time. In the diagram below, there is a single
instance of Resource 1 and it is held by Process 1 only.
System model: Deadlock characterization

Hold and Wait

A process can hold multiple resources and still request more
resources from other processes which are holding them. In
the diagram given below, Process 2 holds Resource 2 and
Resource 3 and is requesting the Resource 1 which is held by
Process 1.
System model: Deadlock characterization

No Preemption
A resource cannot be preempted from a process by force. A
process can only release a resource voluntarily. In the
diagram below, Process 2 cannot preempt Resource 1 from
Process 1. It will only be released when Process 1
relinquishes it voluntarily after its execution is complete.
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
DEADLOCKS
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Methods of handling deadlocks

Deadlock Ignorance, Deadlock Detection, Deadlock Prevention

and deadlock avoidance are the main methods for handling
deadlocks.

1. Deadlock Ignorance
Deadlock Ignorance is the most widely used approach
among all the mechanism. This is being used by many
operating systems mainly for end user uses.
In this approach, the Operating system assumes that
deadlock never occurs. It simply ignores deadlock. This
approach is best suitable for a single end user system
where User uses the system only for browsing and all
other normal stuff
Methods of handling deadlocks

• There is always a tradeoff between Correctness and

performance. The operating systems like Windows and Linux
mainly focus upon performance.

• However, the performance of the system decreases if it uses

deadlock handling mechanism all the time if deadlock happens 1
out of 100 times then it is completely unnecessary to use the
deadlock handling mechanism all the time.

• In these types of systems, the user has to simply restart the

computer in the case of deadlock. Windows and Linux are mainly
using this approach.
Methods of handling deadlocks

Deadlock Ignorance, Deadlock Detection, Deadlock Prevention

and deadlock avoidance are the main methods for handling
deadlocks.

Deadlock Prevention
Deadlock happens only when Mutual Exclusion, hold
and wait, No preemption and circular wait holds
simultaneously. If it is possible to violate one of the
four conditions at any time then the deadlock can
never occur in the system.

The idea behind the approach is very simple that we

have to fail one of the four conditions but there can be
a big argument on its physical implementation in the
Methods of handling deadlocks

3. Deadlock avoidance
In deadlock avoidance, the operating system checks
whether the system is in safe state or in unsafe state at
every step which the operating system performs. The
process continues until the system is in safe state. Once
the system moves to unsafe state, the OS has to backtrack
one step.

In simple words, The OS reviews each allocation so that

the allocation doesn't cause the deadlock in the system.
We will discuss Deadlock avoidance later in detail.
Methods of handling deadlocks

4. Deadlock Detection and Recovery

This approach let the processes fall in deadlock and then

periodically check whether deadlock occur in the system
or not. If it occurs then it applies some of the recovery
methods to the system to get rid of deadlock.

We will discuss deadlock detection and recovery later in

more detail since it is a matter of discussion.
Deadlock Prevention

• If we simulate deadlock with a table which is standing on

its four legs then we can also simulate four legs with the
four conditions which when occurs simultaneously, cause
the deadlock.

• However, if we break one of the legs of the table then the

table will fall definitely. The same happens with deadlock,
if we can be able to violate one of the four necessary
conditions and don't let them occur together then we can
prevent the deadlock.
Deadlock Prevention

1. Mutual Exclusion
Mutual section from the resource point of view is the fact
that a resource can never be used by more than one
process simultaneously which is fair enough but that is
the main reason behind the deadlock.

If a resource could have been used by more than one

process at the same time then the process would have
never been waiting for any resource.

However, if we can be able to violate resources

behaving in the mutually exclusive manner then the
deadlock can be prevented.
Deadlock Prevention

Spooling

For a device like printer, spooling can work. There is a

memory associated with the printer which stores jobs from
each of the process into it.

Later, Printer collects all the jobs and print each one of them
according to FCFS. By using this mechanism, the process
doesn't have to wait for the printer and it can continue
whatever it was doing. Later, it collects the output when it is
produced
Deadlock Prevention

Although, Spooling can be an effective approach to violate mutual

exclusion but it suffers from two kinds of problems.
1.This cannot be applied to every resource.
2.After some point of time, there may arise a race condition
between the processes to get space in that spool.
Deadlock Prevention

We cannot force a resource to be used by more than one process at the

same time since it will not be fair enough and some serious problems
may arise in the performance. Therefore, we cannot violate mutual
exclusion for a process practically.

Hold and wait condition lies when a process holds a resource and
waiting for some other resource to complete its task. Deadlock
occurs because there can be more than one process which are
holding one resource and waiting for other in the cyclic order.

However, we have to find out some mechanism by which a

process either doesn't hold any resource or doesn't wait. That
means, a process must be assigned all the necessary resources
before the execution starts. A process must not wait for any
resource once the execution has been started.
Deadlock Prevention

!(Hold and wait) = !hold or !wait (negation of hold and wait is, either
you don't hold or you don't wait)

This can be implemented practically if a process declares all the

resources initially. However, this sounds very practical but can't be
done in the computer system because a process can't determine
necessary resources initially.
Process is the set of instructions which are executed by the CPU.
Each of the instruction may demand multiple resources at the
multiple times. The need cannot be fixed by the OS.
The problem with the approach is:
1.Practically not possible.
2.Possibility of getting starved will be increases due to the fact
that some process may hold a resource for a very long time.
Deadlock Prevention

3. No Preemption
Deadlock arises due to the fact that a process can't be stopped
once it starts. However, if we take the resource away from the
process which is causing deadlock then we can prevent
deadlock.
This is not a good approach at all since if we take a resource
away which is being used by the process then all the work which
it has done till now can become inconsistent.
Consider a printer is being used by any process. If we take the
printer away from that process and assign it to some other
process then all the data which has been printed can become
inconsistent and ineffective and also the fact that the process
can't start printing again from where it has left which causes
performance inefficiency.
Deadlock Prevention

4. Circular Wait
To violate circular wait, we can assign a priority number to each
of the resource. A process can't request for a lesser priority
resource. This ensures that not a single process can request a
resource which is being utilized by some other process and no
cycle will be formed.

Among all the methods, violating Circular wait is the only approach that can be
implemented practically.
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
DEADLOCKS
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Methods of handling deadlocks

Deadlock Ignorance, Deadlock Detection, Deadlock Prevention

and deadlock avoidance are the main methods for handling
deadlocks.

1. Deadlock Ignorance
Deadlock Ignorance is the most widely used approach
among all the mechanism. This is being used by many
operating systems mainly for end user uses.
In this approach, the Operating system assumes that
deadlock never occurs. It simply ignores deadlock. This
approach is best suitable for a single end user system
where User uses the system only for browsing and all
other normal stuff
Methods of handling deadlocks

• There is always a tradeoff between Correctness and

performance. The operating systems like Windows and Linux
mainly focus upon performance.

• However, the performance of the system decreases if it uses

deadlock handling mechanism all the time if deadlock happens 1
out of 100 times then it is completely unnecessary to use the
deadlock handling mechanism all the time.

• In these types of systems, the user has to simply restart the

computer in the case of deadlock. Windows and Linux are mainly
using this approach.
Methods of handling deadlocks

Deadlock Ignorance, Deadlock Detection, Deadlock Prevention

and deadlock avoidance are the main methods for handling
deadlocks.

Deadlock Prevention
Deadlock happens only when Mutual Exclusion, hold
and wait, No preemption and circular wait holds
simultaneously. If it is possible to violate one of the
four conditions at any time then the deadlock can
never occur in the system.

The idea behind the approach is very simple that we

have to fail one of the four conditions but there can be
a big argument on its physical implementation in the
Methods of handling deadlocks

3. Deadlock avoidance
In deadlock avoidance, the operating system checks
whether the system is in safe state or in unsafe state at
every step which the operating system performs. The
process continues until the system is in safe state. Once
the system moves to unsafe state, the OS has to backtrack
one step.

In simple words, The OS reviews each allocation so that

the allocation doesn't cause the deadlock in the system.
We will discuss Deadlock avoidance later in detail.
Methods of handling deadlocks

4. Deadlock Detection and Recovery

This approach let the processes fall in deadlock and then

periodically check whether deadlock occur in the system
or not. If it occurs then it applies some of the recovery
methods to the system to get rid of deadlock.

We will discuss deadlock detection and recovery later in

more detail since it is a matter of discussion.
Deadlock Prevention

• If we simulate deadlock with a table which is standing on

its four legs then we can also simulate four legs with the
four conditions which when occurs simultaneously, cause
the deadlock.

• However, if we break one of the legs of the table then the

table will fall definitely. The same happens with deadlock,
if we can be able to violate one of the four necessary
conditions and don't let them occur together then we can
prevent the deadlock.
Deadlock Prevention

1. Mutual Exclusion
Mutual section from the resource point of view is the fact
that a resource can never be used by more than one
process simultaneously which is fair enough but that is
the main reason behind the deadlock.

If a resource could have been used by more than one

process at the same time then the process would have
never been waiting for any resource.

However, if we can be able to violate resources

behaving in the mutually exclusive manner then the
deadlock can be prevented.
Deadlock Prevention

Spooling

For a device like printer, spooling can work. There is a

memory associated with the printer which stores jobs from
each of the process into it.

Later, Printer collects all the jobs and print each one of them
according to FCFS. By using this mechanism, the process
doesn't have to wait for the printer and it can continue
whatever it was doing. Later, it collects the output when it is
produced
Deadlock Prevention

Although, Spooling can be an effective approach to violate mutual

exclusion but it suffers from two kinds of problems.
1.This cannot be applied to every resource.
2.After some point of time, there may arise a race condition
between the processes to get space in that spool.
Deadlock Prevention

We cannot force a resource to be used by more than one process at the

same time since it will not be fair enough and some serious problems
may arise in the performance. Therefore, we cannot violate mutual
exclusion for a process practically.

Hold and wait condition lies when a process holds a resource and
waiting for some other resource to complete its task. Deadlock
occurs because there can be more than one process which are
holding one resource and waiting for other in the cyclic order.

However, we have to find out some mechanism by which a

process either doesn't hold any resource or doesn't wait. That
means, a process must be assigned all the necessary resources
before the execution starts. A process must not wait for any
resource once the execution has been started.
Deadlock Prevention

!(Hold and wait) = !hold or !wait (negation of hold and wait is, either
you don't hold or you don't wait)

This can be implemented practically if a process declares all the

resources initially. However, this sounds very practical but can't be
done in the computer system because a process can't determine
necessary resources initially.
Process is the set of instructions which are executed by the CPU.
Each of the instruction may demand multiple resources at the
multiple times. The need cannot be fixed by the OS.
The problem with the approach is:
1.Practically not possible.
2.Possibility of getting starved will be increases due to the fact
that some process may hold a resource for a very long time.
Deadlock Prevention

3. No Preemption
Deadlock arises due to the fact that a process can't be stopped
once it starts. However, if we take the resource away from the
process which is causing deadlock then we can prevent
deadlock.
This is not a good approach at all since if we take a resource
away which is being used by the process then all the work which
it has done till now can become inconsistent.
Consider a printer is being used by any process. If we take the
printer away from that process and assign it to some other
process then all the data which has been printed can become
inconsistent and ineffective and also the fact that the process
can't start printing again from where it has left which causes
performance inefficiency.
Deadlock Prevention

4. Circular Wait
To violate circular wait, we can assign a priority number to each
of the resource. A process can't request for a lesser priority
resource. This ensures that not a single process can request a
resource which is being utilized by some other process and no
cycle will be formed.

Among all the methods, violating Circular wait is the only approach that can be
implemented practically.
Deadlock avoidance

In deadlock avoidance, the request for any resource will be

granted if the resulting state of the system doesn't cause
deadlock in the system. The state of the system will
continuously be checked for safe and unsafe states.
In order to avoid deadlocks, the process must tell OS, the
maximum number of resources a process can request to
complete its execution.

The simplest and most useful approach states that the

process should declare the maximum number of resources
of each type it may ever need. The Deadlock avoidance
algorithm examines the resource allocations so that there
can never be a circular wait condition.
Deadlock avoidance

Safe and Unsafe States

The resource allocation state of a system can be defined by
the instances of available and allocated resources, and the
maximum instance of the resources demanded by the
processes.
A state of a system recorded at some Resources still needed
random time is shown
below.
Process Type Type 2 Type 3 Type 4 Process Type 1 Type 2 Type 3 Type 4
Resources
1 Assigned
A 1 1 0 0
A 3 0 2 2
B 0 1 1 2
B 0 0 1 1
C 1 2 1 0
C 1 1 1 0
D 2 1 4 0 D 2 1 1 2
Deadlock avoidance

1.E = (7 6 8 4)
2.P = (6 2 8 3)
3.A = (1 4 0 1)
• Above tables and vector E, P and A describes the
resource allocation state of a system. There are 4
processes and 4 types of the resources in a system.
Table 1 shows the instances of each resource
assigned to each process.

• Table 2 shows the instances of the resources, each

process still needs. Vector E is the representation of
total instances of each resource in the system.
Deadlock avoidance

• Vector P represents the instances of resources that have been

assigned to processes. Vector A represents the number of
resources that are not in use.

• A state of the system is called safe if the system can allocate all
the resources requested by all the processes without entering
into deadlock.

• If the system cannot fulfill the request of all processes then the
state of the system is called unsafe.

• The key of Deadlock avoidance approach is when the request is

made for resources then the request must only be approved in
the case if the resulting state is also a safe state.
Resource Allocation Graph

• The resource allocation graph is the pictorial

representation of the state of a system. As its name
suggests, the resource allocation graph is the complete
information about all the processes which are holding
some resources or waiting for some resources.

• It also contains the information about all the instances

of all the resources whether they are available or being
used by the processes.

• In Resource allocation graph, the process is represented

by a Circle while the Resource is represented by a
rectangle. Let's see the types of vertices and edges in
Resource Allocation Graph
Resource Allocation Graph

Vertices are mainly of two types, Resource and process. Each of

them will be represented by a different shape. Circle represents
process while rectangle represents resource.
A resource can have more than one instance. Each instance will be
represented by a dot inside the rectangle.
Resource Allocation Graph

Edges in RAG are also of two types, one represents

assignment and other represents the wait of a process for a
resource. The above image shows each of them.
A resource is shown as assigned to a process if the tail of the
arrow is attached to an instance to the resource and the head
is attached to a process.
A process is shown as waiting for a resource if the tail of an
arrow is attached to the process while the head is pointing
towards the resource.
Resource Allocation Graph

Example
Let’s consider 3 processes P1, P2 and P3, and two types of resources
R1 and R2. The resources are having 1 instance each.
According to the graph, R1 is being used by P1, P2 is holding R2 and
waiting for R1, P3 is waiting for R1 as well as R2.
The graph is deadlock free since no cycle is being formed in the
graph.
Resource Allocation Graph

Deadlock Detection using RAG

If a cycle is being formed in a Resource allocation graph where
all the resources have the single instance then the system is
deadlocked.
In Case of Resource allocation graph with multi-instanced
resource types, Cycle is a necessary condition of deadlock but
not the sufficient condition.
The following example contains three processes P1, P2, P3
and three resources R2, R2, R3. All the resources are having
single instances each.
Resource Allocation Graph

If we analyze the graph then we can find out that there

is a cycle formed in the graph since the system is
satisfying all the four conditions of deadlock.
Allocation Matrix
Allocation matrix can be formed by using the Resource
allocation graph of a system. In Allocation matrix, an
entry will be made for each of the resource assigned. For
Example, in the following matrix, en entry is being made
in front of P1 and below R3 since R3 is assigned to P1.
Resource Allocation Graph

Process R1 R2 R3
P1 0 0 1
P2 1 0 0
P3 0 1 0

Request Matrix
In request matrix, an entry will be made for each of the resource
requested. As in the following example, P1 needs R1 therefore an
entry is being made in front of P1 and below R1.

Process R1 R2 R3
P1 1 0 0 Aavial = (0,0,0)
P2 0 1 0
P3 0 0 1
Resource Allocation Graph

Neither we are having any resource available in the

system nor a process going to release. Each of the
process needs at least single resource to complete
therefore they will continuously be holding each one of
them.

We cannot fulfill the demand of at least one process

using the available resources therefore the system is
deadlocked as determined earlier when we detected a
cycle in the graph.
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
DEADLOCKS
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Preventing deadlock

Deadlock can be completely

prevented!
Ensure that at least one of the
conditions for deadlock never occurs
Mutual exclusion
Circular wait
Hold & wait
No preemption
Not always possible…
Deadlock Prevention

• If we simulate deadlock with a table which is standing on

its four legs then we can also simulate four legs with the
four conditions which when occurs simultaneously, cause
the deadlock.

• However, if we break one of the legs of the table then the

table will fall definitely. The same happens with deadlock,
if we can be able to violate one of the four necessary
conditions and don't let them occur together then we can
prevent the deadlock.
Deadlock Prevention

1. Mutual Exclusion
Mutual section from the resource point of view is the fact
that a resource can never be used by more than one
process simultaneously which is fair enough but that is
the main reason behind the deadlock.

If a resource could have been used by more than one

process at the same time then the process would have
never been waiting for any resource.

However, if we can be able to violate resources

behaving in the mutually exclusive manner then the
deadlock can be prevented.
Deadlock Prevention

Spooling

For a device like printer, spooling can work. There is a

memory associated with the printer which stores jobs from
each of the process into it.

Later, Printer collects all the jobs and print each one of them
according to FCFS. By using this mechanism, the process
doesn't have to wait for the printer and it can continue
whatever it was doing. Later, it collects the output when it is
produced
Deadlock Prevention

Although, Spooling can be an effective approach to violate mutual

exclusion but it suffers from two kinds of problems.
1.This cannot be applied to every resource.
2.After some point of time, there may arise a race condition
between the processes to get space in that spool.
Deadlock Prevention

We cannot force a resource to be used by more than one process at the

same time since it will not be fair enough and some serious problems
may arise in the performance. Therefore, we cannot violate mutual
exclusion for a process practically.

Hold and wait condition lies when a process holds a resource and
waiting for some other resource to complete its task. Deadlock
occurs because there can be more than one process which are
holding one resource and waiting for other in the cyclic order.

However, we have to find out some mechanism by which a

process either doesn't hold any resource or doesn't wait. That
means, a process must be assigned all the necessary resources
before the execution starts. A process must not wait for any
resource once the execution has been started.
Deadlock Prevention

Eliminating mutual exclusion

Some devices (such as printer) can be spooled
Only the printer daemon uses printer resource
This eliminates deadlock for printer
Not all devices can be spooled
Principle:
Avoid assigning resource when not absolutely necessary
As few processes as possible actually claim the resource
Deadlock Prevention

Attacking “hold and wait”

Require processes to request resources before starting
A process never has to wait for what it needs
This can present problems
A process may not know required resources at start of run
This also ties up resources other processes could be using
Processes will tend to be conservative and request resources
they might need
Variation: a process must give up all resources before making a new
request
Process is then granted all prior resources as well as the new
ones
Problem: what if someone grabs the resources in the
meantime—how can the process save its state?
Deadlock Prevention

Attacking “no preemption”

This is not usually a viable option
Consider a process given the printer
Halfway through its job, take away the printer
Confusion ensues!
May work for some resources
Forcibly take away memory pages, suspending the
process
Process may be able to resume with no ill effects
Deadlock Prevention

Attacking “circular wait”

Assign an order to resources
Always acquire resources in
numerical order
Need not acquire them all at
once!
Circular wait is prevented
A process holding resource n
can’t wait for resource m
if m < n
No way to complete a cycle
Place processes above the
highest resource they hold
and below any they’re
requesting
All arrows point up!
Deadlock Prevention

Deadlock prevention: summary

Mutual exclusion
Spool everything
Hold and wait
Request all resources initially
No preemption
Take resources away
Circular wait
Order resources numerically
Deadlock Avoidance

• Simplest and most useful model requires that each

process declare the maximum number of resources
of each type that it may need.

• The deadlock-avoidance algorithm dynamically

examines the resource-allocation state to ensure
that there can never be a circular-wait condition.

• Resource-allocation state is defined by the number

of available and allocated resources, and the
maximum demands of the processes.
Deadlock Avoidance

When a process requests an available resource, system must

decide if immediate allocation leaves the system in a safe state
System is in safe state if there exists a sequence <P1, P2, …, Pn>
of ALL the processes in the systems such that for each Pi, the
resources that Pi can still request can be satisfied by currently
available resources + resources held by all the Pj, with j < I
That is:
If Pi resource needs are not immediately available, then Pi
can wait until all Pj have finished
When Pj is finished, Pi can obtain needed resources, execute,
return allocated resources, and terminate
When Pi terminates, Pi +1 can obtain its needed resources,
and so on
Deadlock Avoidance

• Basic Facts
If a system is in safe state  no deadlocks

If a system is in unsafe state  possibility of deadlock

Avoidance  ensure that a system will never enter an unsafe

state.
• Safe, Unsafe, Deadlock State
Deadlock Avoidance

Avoidance Algorithms

Single instance of a resource type

Use a resource-allocation graph

Multiple instances of a resource type

Use the banker’s algorithm
Deadlock Avoidance

Resource-Allocation Graph
Deadlock Avoidance

Resource Allocation Graph: Multiple Ressources

Deadlock Avoidance

Graph With A Cycle But No Basic Facts

Deadlock If graph contains no cycles 
no deadlock
If graph contains a cycle 
if only one instance per
resource type, then
deadlock
necessary and sufficient
condition
if several instances per
resource type, possibility of
deadlock
necessary condition
Resource Allocation Graph

• The resource allocation graph is the pictorial

representation of the state of a system. As its name
suggests, the resource allocation graph is the complete
information about all the processes which are holding
some resources or waiting for some resources.

• It also contains the information about all the instances

of all the resources whether they are available or being
used by the processes.

• In Resource allocation graph, the process is represented

by a Circle while the Resource is represented by a
rectangle. Let's see the types of vertices and edges in
Resource Allocation Graph
Resource Allocation Graph

Vertices are mainly of two types, Resource and process. Each of

them will be represented by a different shape. Circle represents
process while rectangle represents resource.
A resource can have more than one instance. Each instance will be
represented by a dot inside the rectangle.
Resource Allocation Graph

Edges in RAG are also of two types, one represents

assignment and other represents the wait of a process for a
resource. The above image shows each of them.
A resource is shown as assigned to a process if the tail of the
arrow is attached to an instance to the resource and the head
is attached to a process.
A process is shown as waiting for a resource if the tail of an
arrow is attached to the process while the head is pointing
towards the resource.
Resource Allocation Graph

Example
Let’s consider 3 processes P1, P2 and P3, and two types of resources
R1 and R2. The resources are having 1 instance each.
According to the graph, R1 is being used by P1, P2 is holding R2 and
waiting for R1, P3 is waiting for R1 as well as R2.
The graph is deadlock free since no cycle is being formed in the
graph.
Resource Allocation Graph

Deadlock Detection using RAG

If a cycle is being formed in a Resource allocation graph where
all the resources have the single instance then the system is
deadlocked.
In Case of Resource allocation graph with multi-instanced
resource types, Cycle is a necessary condition of deadlock but
not the sufficient condition.
The following example contains three processes P1, P2, P3 and
three resources R2, R2, R3. All the resources are having single
instances each.
Resource Allocation Graph

If we analyze the graph then we can find out that there is

a cycle formed in the graph since the system is satisfying
all the four conditions of deadlock.
Allocation Matrix
Allocation matrix can be formed by using the Resource
allocation graph of a system. In Allocation matrix, an
entry will be made for each of the resource assigned. For
Example, in the following matrix, an entry is being made
in front of P1 and below R3 since R3 is assigned to P1.
Process R1 R2 R3

P1 0 0 1
P2 1 0 0
P3 0 1 0
Resource Allocation Graph

Request Matrix
In request matrix, an entry will be made for each of the
resource requested. As in the following example, P1
needs R1 therefore an entry is being made in front of P1
and below R1.

Process R1 R2 R3

P1 1 0 0

P2 0 1 0

P3 0 0 1
Resource Allocation Graph

Neither we are having any resource available in the

system nor a process going to release. Each of the
process needs at least single resource to complete
therefore they will continuously be holding each one of
them.

We cannot fulfill the demand of at least one process

using the available resources therefore the system is
deadlocked as determined earlier when we detected a
cycle in the graph.
Deadlock Avoidance

Claim edge Pi  Rj indicated that process Pj may request

resource Rj; represented by a dashed line
Claim edge converts to request edge when a process
requests a resource
Request edge converted to an assignment edge when the
resource is allocated to the process
When a resource is released by a process, assignment edge
reconverts to a claim edge
Resources must be claimed a priori in the system
Deadlock Avoidance

Claim edge Pi  Rj indicated that process Pj may

request resource Rj; represented by a dashed line
Claim edge converts to request edge when a process
requests a resource
Request edge converted to an assignment edge when
the resource is allocated to the process
When a resource is released by a process, assignment
edge reconverts to a claim edge
Resources must be claimed a priori in the system
Deadlock Avoidance

Suppose that process Pi requests a resource Rj

The request can be granted only if converting the request edge to an
assignment edge does not result in the formation of a cycle in the
resource allocation graph
Deadlock Avoidance

Multiple instances

• Each process must a priori claim maximum use

• When a process requests a resource it may have to wait
• When a process gets all its resources it must return
them in a finite amount of time
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
Protection in Operating System
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Protection in Operating System

• Protection is especially important in a multiuser

environment when multiple users use computer
resources such as CPU, memory, etc.

• It is the operating system's responsibility to offer a

mechanism that protects each process from other
processes.

• In a multiuser environment, all assets that require

protection are classified as objects, and those that wish
to access these objects are referred to as subjects.

• The operating system grants different 'access rights' to

different subjects.
Protection in Operating System

• A mechanism that controls the access of programs,

processes, or users to the resources defined by a
computer system is referred to as protection.

• protection as a tool for multi-programming operating

systems, allowing multiple users to safely share a
common logical namespace, including a directory or
files.
• Protection may be achieved by maintaining
confidentiality, honesty and availability in the OS.

• It is critical to secure the device from unauthorized

access, viruses, worms, and other malware.
Need of Protection in Operating System

Various needs of protection in the operating system are as

follows:
• There may be security risks like unauthorized reading,
writing, modification, or preventing the system from
working effectively for authorized users.
• It helps to ensure data security, process security, and
program security against unauthorized user access or
program access.
• It is important to ensure no access rights' breaches, no
viruses, no unauthorized access to the existing data.
• Its purpose is to ensure that only the systems' policies
access programs, resources, and data.
Goals of Protection in Operating System

Various goals of protection in the operating system are

as follows:

• The policies define how processes access the

computer system's resources, such as the CPU,
memory, software, and even the operating system.

• It is the responsibility of both the operating system

designer and the app programmer. Although, these
policies are modified at any time.
Goals of Protection in Operating System

• Protection is a technique for protecting data and

processes from harmful or intentional infiltration.

• It contains protection policies either established by

itself, set by management or imposed individually by
programmers to ensure that their programs are
protected to the greatest extent possible.

• It also provides a multiprogramming OS with the

security that its users expect when sharing common
space such as files or directories.
Principles of Protection

• The principle of least privilege dictates that programs,

users, and systems be given just enough privileges to
perform their tasks.

• This ensures that failures do the least amount of harm and

allow the least of harm to be done.

• For example, if a program needs special privileges to

perform a task, it is better to make it a SGID program with
group ownership of "network" or "backup" or some other
pseudo group, rather than SUID with root ownership.

• This limits the amount of damage that can occur if

something goes wrong.
Principles of Protection

•Typically each user is given their own account, and has only
enough privilege to modify their own files.

•The root account should not be used for normal day to day
activities - The System Administrator should also have an
ordinary account, and reserve use of the root account for only
those tasks which need the root privileges
Role of Protection in Operating System

• Its main role is to provide a mechanism for

implementing policies that define the use of resources
in a computer system.
• Some rules are set during the system's design, while
others are defined by system administrators to secure
their files and programs.
• Every program has distinct policies for using resources,
and these policies may change over time.
• Therefore, system security is not the responsibility of
the system's designer, and the programmer must also
design the protection technique to protect their system
against infiltration.
Domain of Protection in Operating System

Various domains of protection in operating system are

as follows:
• The protection policies restrict each process's
access to its resource handling.
• A process is obligated to use only the resources
necessary to fulfil its task within the time
constraints and in the mode in which it is required.
It is a process's protected domain.
• Processes and objects are abstract data types in a
computer system, and these objects have
operations that are unique to them. A domain
component is defined as <object, {set of
operations on object}>.
Domain of Protection in Operating System

• Each domain consists of a set of objects and the

operations that can be performed on them.

• A domain can consist of either only a process or a

procedure or a user.

• Then, if a domain corresponds to a procedure, then

changing domain would mean changing procedure ID.
Objects may share a common operation or two. Then
the domains overlap.
Domain of Protection in Operating System

Figure 1 - System with three protection domains.

Domain of Protection in Operating System

• Association between process and domain :

• Processes switch from one domain to other when they
have the access right to do so. It can be of two types as
follows.

• Fixed or static –
• In fixed association, all the access rights can be given to
the processes at the very beginning but that give rise to
a lot of access rights for domain switching.

• So, a way of changing the contents of the domain are

found dynamically.
Domain of Protection in Operating System

• Changing or dynamic –
In dynamic association where a process can switch
dynamically, creating a new domain in the process, if
need be.

• If the association is dynamic, then there needs to be a

mechanism for domain switching.

• Domains may be realized in different fashions - as

users, or as processes, or as procedures. E.g. if each
user corresponds to a domain, then that domain
defines the access of that user, and changing domains
involves changing user ID.
Domain of Protection in Operating System

An Example: UNIX
•UNIX associates domains with users.
•Certain programs operate with the SUID bit set, which effectively
changes the user ID, and therefore the access domain, while the program
is running. ( and similarly for the SGID bit. ) Unfortunately this has
some potential for abuse.
•An alternative used on some systems is to place privileged programs in
special directories, so that they attain the identity of the directory owner
when they run. This prevents crackers from placing SUID programs in
random directories around the system.
•Yet another alternative is to not allow the changing of ID at all. Instead,
special privileged daemons are launched at boot time, and user processes
send messages to these daemons when they need special tasks
performed.
Domain of Protection in Operating System

An Example: MULTICS
The MULTICS system uses a complex system of rings, each
corresponding to a different protection domain, as shown below:

Figure 2 - MULTICS ring structure.

Domain of Protection in Operating System

• Rings are numbered from 0 to 7, with outer rings having a subset

of the privileges of the inner rings.

• Each file is a memory segment, and each segment description

includes an entry that indicates the ring number associated with
that segment, as well as read, write, and execute privileges.

• Each process runs in a ring, according to the current-ring-number, a

counter associated with each process.

• A process operating in one ring can only access segments

associated with higher ( farther out ) rings, and then only according
to the access bits. Processes cannot access segments associated
with lower rings.
Domain of Protection in Operating System

•Domain switching is achieved by a process in one ring calling upon a process

operating in a lower ring, which is controlled by several factors stored with each
segment descriptor:
• An access bracket, defined by integers b1 <= b2.
• A limit b3 > b2
• A list of gates, identifying the entry points at which the segments may be
called.
•If a process operating in ring i calls a segment whose bracket is such that b1 <= i <=
b2, then the call succeeds and the process remains in ring i.
•Otherwise a trap to the OS occurs, and is handled as follows:
• If i < b1, then the call is allowed, because we are transferring to a procedure
with fewer privileges. However if any of the parameters being passed are of
segments below b1, then they must be copied to an area accessible by the
called procedure.
• If i > b2, then the call is allowed only if i <= b3 and the call is directed to one
of the entries on the list of gates.
•Overall this approach is more complex and less efficient than other protection
schemes.
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
Access matrix, implementation of
Access matrix
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Access matrix, implementation of Access matrix

The Access Matrix is a security model for a computer

system's protection state. It is described as a matrix.
An access matrix is used to specify the permissions of each
process running in the domain for each object.

The rows of the matrix represent domains, whereas the

columns represent objects.

Every matrix cell reflects a set of access rights granted to

domain processes, i.e., each entry (i, j) describes the set of
operations that a domain Di process may invoke on
object Oj.
Access matrix, implementation of Access matrix

Now, let's take an example to understand the

implementation of an access matrix in the operating
system.
Example:
Access matrix, implementation of Access matrix

There are various methods of implementing the access

matrix in the operating system. These methods are as
follows:

1.Global Table
2.Access Lists for Objects
3.Capability Lists for Domains
4.Lock-Key Mechanism
Access matrix, implementation of Access matrix

Global Table
• It is the most basic access matrix implementation.
• A set of ordered triples <domain, object, rights-
set> is maintained in a file.
• When an operation M has been performed on an
object Oj within domain Di, the table is searched for
a triple <Di, Oj, Rk>.
• The operation can proceed if this triple is located;
otherwise, an exception (or error) condition has
arrived. This implementation has various drawbacks.
• The table is generally large and cannot be stored in
the main memory, so additional input and output are
required.
Access matrix, implementation of Access matrix

Access Lists for Objects

• Every access matrix column may be used as a
single object's access list.
• It is possible to delete the blank entries. For each
object, the resulting list contains ordered
pairs <domain, rights-set> that define all domains
for that object and a nonempty set of access rights.
• We may start by checking the default set and then
find the access list.
• If the item is found, we enable the action; if it isn't,
we verify the default set.
• If M is in the default set, we grant access. Access is
denied if this is not the case, and an extraordinary
scenario arises.
Access matrix, implementation of Access matrix

Capability Lists for Domains

• A domain's capability list is a collection of objects
and the actions that can be done on them.
• A capacity is a name or address that is used to
define an object.
• If you want to perform operation M on object Oj, the
process runs operation M, specifying the capability
for object Oj.
• The simple possession of the capability implies that
access is allowed.
Access matrix, implementation of Access matrix

Capability Lists for Domains

• In most cases, capabilities are separated from other
data in one of two ways.
• Every object has a tag to indicate its type as
capability data. Alternatively, a program's address
space can be divided into two portions.
• The programs may access one portion, including the
program's normal instructions and data.
• The other portion is a capability list that is only
accessed by the operating system.
Access matrix, implementation of Access matrix

Lock-Key Mechanism
• It is a compromise between the access lists and the
capability lists.
• Each object has a list of locks, which are special bit
patterns. On the other hand, each domain has a set
of keys that are special bit patterns.
• A domain-based process could only access an
object if a domain has a key that satisfies one of the
locks on the object.
• The process is not allowed to modify its keys.
Access matrix, implementation of Access matrix

In this example, there are 4 domains and objects in

the above matrix, and also consider 3 files (including
F1, F2, and F3) and one printer. Files F1 and F3 can
be read by a process running in D1.
A process running in domain D4 has the same rights
as D1, but it may also write on files. Only one process
running in domain D2 has access to the printer.
The access matrix mechanism is made up of various
policies and semantic features.
Specifically, we should ensure that a process running
in domain Di may only access the objects listed in row
i.
Access matrix, implementation of Access matrix

• The protection policies in the access matrix

determine which rights must be included in the (i
j)th entry.
• We should also choose the domain in which each
process runs. The OS usually decides this policy.
• The Users determine the data of the access-matrix
entries.
• The relationship between the domain and the
processes might be static or dynamic.
• The access matrix provides a way for defining the
control for this domain-process association.
Access matrix, implementation of Access matrix

• We perform a switch action on an object when we

switch a process from one domain to another.

• We may regulate domain switching by containing

domains between the access matrix objects.

• If they have access to switch rights, processes must

be enabled to switch from one domain (Di) to
another domain (Dj).

According to the matrix, a process running in

domain D2 can transition to domains D3 and D4. A
process in domain D4 may change to domain D1, and
a process in domain D1 may change to domain D2.
Access matrix, implementation of Access matrix
INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
Access matrix, implementation of
Access matrix
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Access matrix, implementation of Access matrix

The Access Matrix is a security model for a computer

system's protection state. It is described as a matrix.
An access matrix is used to specify the permissions of each
process running in the domain for each object.

The rows of the matrix represent domains, whereas the

columns represent objects.

Every matrix cell reflects a set of access rights granted to

domain processes, i.e., each entry (i, j) describes the set of
operations that a domain Di process may invoke on
object Oj.
Access matrix, implementation of Access matrix

Now, let's take an example to understand the

implementation of an access matrix in the operating
system.
Example:
Access matrix, implementation of Access matrix

There are various methods of implementing the access

matrix in the operating system. These methods are as
follows:

1.Global Table
2.Access Lists for Objects
3.Capability Lists for Domains
4.Lock-Key Mechanism
Access matrix, implementation of Access matrix

Global Table
• It is the most basic access matrix implementation.
• A set of ordered triples <domain, object, rights-
set> is maintained in a file.
• When an operation M has been performed on an
object Oj within domain Di, the table is searched for
a triple <Di, Oj, Rk>.
• The operation can proceed if this triple is located;
otherwise, an exception (or error) condition has
arrived. This implementation has various drawbacks.
• The table is generally large and cannot be stored in
the main memory, so additional input and output are
required.
Access matrix, implementation of Access matrix

Access Lists for Objects

• Every access matrix column may be used as a
single object's access list.
• It is possible to delete the blank entries. For each
object, the resulting list contains ordered
pairs <domain, rights-set> that define all domains
for that object and a nonempty set of access rights.
• We may start by checking the default set and then
find the access list.
• If the item is found, we enable the action; if it isn't,
we verify the default set.
• If M is in the default set, we grant access. Access is
denied if this is not the case, and an extraordinary
scenario arises.
Access matrix, implementation of Access matrix

Capability Lists for Domains

• A domain's capability list is a collection of objects
and the actions that can be done on them.
• A capacity is a name or address that is used to
define an object.
• If you want to perform operation M on object Oj, the
process runs operation M, specifying the capability
for object Oj.
• The simple possession of the capability implies that
access is allowed.
Access matrix, implementation of Access matrix

Capability Lists for Domains

• In most cases, capabilities are separated from other
data in one of two ways.
• Every object has a tag to indicate its type as
capability data. Alternatively, a program's address
space can be divided into two portions.
• The programs may access one portion, including the
program's normal instructions and data.
• The other portion is a capability list that is only
accessed by the operating system.
Access matrix, implementation of Access matrix

Lock-Key Mechanism
• It is a compromise between the access lists and the
capability lists.
• Each object has a list of locks, which are special bit
patterns. On the other hand, each domain has a set
of keys that are special bit patterns.
• A domain-based process could only access an
object if a domain has a key that satisfies one of the
locks on the object.
• The process is not allowed to modify its keys.
Access matrix, implementation of Access matrix

In this example, there are 4 domains and objects in

the above matrix, and also consider 3 files (including
F1, F2, and F3) and one printer. Files F1 and F3 can
be read by a process running in D1.
A process running in domain D4 has the same rights
as D1, but it may also write on files. Only one process
running in domain D2 has access to the printer.
The access matrix mechanism is made up of various
policies and semantic features.
Specifically, we should ensure that a process running
in domain Di may only access the objects listed in row
i.
Access matrix, implementation of Access matrix

• The protection policies in the access matrix

determine which rights must be included in the (i
j)th entry.
• We should also choose the domain in which each
process runs. The OS usually decides this policy.
• The Users determine the data of the access-matrix
entries.
• The relationship between the domain and the
processes might be static or dynamic.
• The access matrix provides a way for defining the
control for this domain-process association.
Access matrix, implementation of Access matrix

• We perform a switch action on an object when we

switch a process from one domain to another.

• We may regulate domain switching by containing

domains between the access matrix objects.

• If they have access to switch rights, processes must

be enabled to switch from one domain (Di) to
another domain (Dj).

According to the matrix, a process running in

domain D2 can transition to domains D3 and D4. A
process in domain D4 may change to domain D1, and
a process in domain D1 may change to domain D2.
Access matrix, implementation of Access matrix
 INSTITUTE OFAERONAUTICAL ENGINEERING
(Autonomous)
Dundigal, Hyderabad - 500 043

Module-V
Access control, revocation of access
rights
by

Dr. Y Mohana Roopa

Professor Department of CSE

1
Access control, revocation of access rights

• Access Control is an approach of security that controls

access both physically and virtually unless authentication
credentials are supported.
• Access control generally defined restricting physical
access to a facility, building or room to authorized
persons.
• This can be used to be enforced generally through a
physical security guard.
• An Access Control system generally involves locked gates,
doors or barriers which can be opened using identity
authentication approaches such as RFID access cards, pin
codes, face recognition, finger prints or smartphones to
enable entry to a building or specific area.
Access control, revocation of access rights

Access control includes data and physical access

protections that strengthen cybersecurity by handling
user authentication to systems.

Managing access defines setting and enforcing suitable

user authorization, authentication, role-based access
control policies (RBAC), attribute-based access control
policies (ABAC).
Access control, revocation of access rights

• An Access Control system enables complete control

of which users have access to different areas.
• Because authorisation is given, an employee can
access some areas they required for their job. Using a
key card or inputting a PIN for instance, the
employee can access multiple doors, gates &
barriers, or designated routes with ease.
• Access control evolved into the authentication,
authorization and audit of a user for a session.
• Access control authentication devices evolved to
contains id and password, digital certificates, security
tokens, smart cards and biometrics.
Access control, revocation of access rights

• RBAC is generally found in government, military and

multiple enterprises where the role definitions are
well defined, the pace of change is not that quick
and the supporting human resource environment is
capable of maintaining up with changes to an
identity their roles and privileges.

• Access control is the procedure by which users are

identified and granted specific privileges to
information, systems, or resources. Understanding
the element of access control is essential to
understanding how to handle proper disclosure of
information.
Access control, revocation of access rights

• Access control is the ability to allow or deny the use

of a specific resource by a specific entity.
• Access control structure can be used in handling
physical resources (including a movie theatre, to
which only ticket-holders must be admitted), logical
resources (a bank account, with a limited number of
people authorized to create a withdrawal), or digital
resources.
• Digital resources involves a private text files on a
computer, which only specific users should be able to
read.
Access control, revocation of access rights

Protection can be applied to non-file

resources
Oracle Solaris 10 provides role-based access
control (RBAC) to implement least privilege
Privilege is right to execute system call
or use an option within a system call
Can be assigned to processes
Users assigned roles granting access to
privileges and programs
Enable role via password to gain its
privileges
Similar to access matrix
Revocation of access rights

Various options to remove the access right of a domain to an

object
Immediate vs. delayed
Selective vs. general
Partial vs. total
Temporary vs. permanent

Access List – Delete access rights from access list

Simple – search access list and remove entry
Immediate, general or selective, total or partial,
permanent or temporary
Revocation of access rights

Capability List – Scheme required to locate capability in the system

before capability can be revoked
Reacquisition – periodic delete, with require and denial if
revoked
Back-pointers – set of pointers from each object to all
capabilities of that object (Multics)
Indirection – capability points to global table entry which points
to object – delete entry from global table, not selective (CAL)
Keys – unique bits associated with capability, generated when
capability created
Master key associated with object, key matches master key
for access
Revocation – create new master key
Policy decision of who can create and modify keys – object
owner or others?
Capability-Based Systems

Hydra
Fixed set of access rights known to and interpreted by the system
i.e. read, write, or execute each memory segment
User can declare other auxiliary rights and register those with
protection system
Accessing process must hold capability and know name of
operation
Rights amplification allowed by trustworthy procedures for a
specific type
Interpretation of user-defined rights performed solely by user's
program; system provides access protection for use of these rights
Operations on objects defined procedurally – procedures are
objects accessed indirectly by capabilities
Solves the problem of mutually suspicious subsystems
Includes library of prewritten security routines
Capability-Based Systems

Cambridge CAP System

Simpler but powerful
Data capability - provides standard read, write, execute of
individual storage segments associated with object –
implemented in microcode
Software capability -interpretation left to the subsystem, through
its protected procedures
Only has access to its own subsystem
Programmers must learn principles and techniques of
protection
Language-Based Protection

• Specification of protection in a programming language

allows the high-level description of policies for the
allocation and use of resources
• Language implementation can provide software for
protection enforcement when automatic hardware-
supported checking is unavailable
• Interpret protection specifications to generate calls on
whatever protection system is provided by the
hardware and the operating system
Protection in Java 2

Protection is handled by the Java Virtual Machine (JVM)

A class is assigned a protection domain when it is loaded by the
JVM
The protection domain indicates what operations the class can
(and cannot) perform
If a library method is invoked that performs a privileged operation,
the stack is inspected to ensure the operation can be performed
by the library
Generally, Java’s load-time and run-time checks enforce type
safety
Classes effectively encapsulate and protect data and methods
from other classes
Stack Inspection

Protection is handled by the Java Virtual Machine (JVM)

A class is assigned a protection domain when it is loaded by the
JVM
The protection domain indicates what operations the class can
(and cannot) perform
If a library method is invoked that performs a privileged operation,
the stack is inspected to ensure the operation can be performed
by the library
Generally, Java’s load-time and run-time checks enforce type
safety
Classes effectively encapsulate and protect data and methods
from other classes
Stack Inspection