A Portable User-Level Approach for System-Wide Integrity Protection†
A Portable User-Level Approach for System-wide Integrity Protectiony Wai-Kit Sze and R. Sekar Stony Brook University Stony Brook, NY, USA ABSTRACT • Difficulty of secure policy enforcement. Non-bypassable poli- In this paper, we develop an approach for protecting system in- cies usually have to be enforced in the OS kernel. They are usu- tegrity from untrusted code that may harbor sophisticated malware. ally much harder to develop than user-level defenses. Moreover, We develop a novel dual-sandboxing architecture to confine not kernel-based solutions cannot be easily ported across different only untrusted, but also benign processes. Our sandboxes place OSes, or even different versions of the same OS. only a few restrictions, thereby permitting most applications to An alternative to sandboxing is isolated execution of untrusted code. function normally. Our implementation is performed entirely at One-way isolation [15, 23] permits untrusted software to read any- the user-level, requiring no changes to the kernel. This enabled us thing, but its outputs are held in isolation. Two-way isolation limits to port the system easily from Linux to BSD. Our experimental re- both reads and writes, holding the inputs as well as outputs of un- sults show that our approach preserves the usability of applications, trusted applications in an isolated environment. The app model on while offering strong protection and good performance. Moreover, Android, Apple iOS, and Windows 8 sandbox are generally based policy development is almost entirely automated, sparing users and on this two-way isolation model. administrators this cumbersome and difficult task. Isolation approaches provide stronger protection from malware since they block all interactions between untrusted and benign soft- 1.
[Show full text]