Alcatraz: An Isolated Environment for Experimenting with Untrusted Software
Alcatraz: An Isolated Environment for Experimenting with Untrusted Software
复制标题
Alcatraz：用于试验不受信任软件的隔离环境
DOI：
10.1145/1455526.1455527
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
R. Sekar
中科院分区：
文献类型：
--
作者：
Zhenkai Liang;Weiqing Sun;V. Venkatakrishnan;R. Sekar
在本文中，我们提出了一种实现安全执行环境 (SEE) 的方法，使用户能够“尝试”新软件（或对现有软件进行配置更改），而不必担心以任何方式损坏系统。我们的 SEE 的一个关键特性是它忠实地再现了应用程序的行为，就好像它们在底层（主机）操作系统上本机运行一样。这是通过单向隔离来实现的：在 SEE 内运行的进程被授予对主机操作系统提供的环境的读取访问权限，但它们的写入操作被阻止逃逸到 SEE 之外。因此，SEE 进程不会影响主机操作系统进程的行为或主机操作系统上数据的完整性。 SEE 支持广泛的任务，包括：恶意代码研究、不受信任软件的受控执行、软件配置更改实验、软件补丁测试等。它为用户检查 SEE 中所做的系统更改提供了一种便捷的方法。如果不接受这些更改，只需单击按钮即可将其回滚。否则，可以提交更改以便在 SEE 外部可见。我们提供一致性标准来确保提交结果的语义一致性。我们开发了两种不同的实现方法，一种在用户态，另一种在操作系统内核，以实现安全执行环境。我们的实施结果表明，大多数软件，包括相当复杂的服务器和客户端应用程序，都可以在我们的 SEE 中成功运行。它带来的性能开销较低，通常低于 10%。
In this article, we present an approach for realizing a safe execution environment (SEE) that enables users to “try out” new software (or configuration changes to existing software) without the fear of damaging the system in any manner. A key property of our SEE is that it faithfully reproduces the behavior of applications, as if they were running natively on the underlying (host) operating system. This is accomplished via one-way isolation: processes running within the SEE are given read-access to the environment provided by the host OS, but their write operations are prevented from escaping outside the SEE. As a result, SEE processes cannot impact the behavior of host OS processes, or the integrity of data on the host OS. SEEs support a wide range of tasks, including: study of malicious code, controlled execution of untrusted software, experimentation with software configuration changes, testing of software patches, and so on. It provides a convenient way for users to inspect system changes made within the SEE. If these changes are not accepted, they can be rolled back at the click of a button. Otherwise, the changes can be committed so as to become visible outside the SEE. We provide consistency criteria that ensure semantic consistency of the committed results. We develop two different implementation approaches, one in user-land and the other in the OS kernel, for realizing a safe-execution environment. Our implementation results show that most software, including fairly complex server and client applications, can run successfully within our SEEs. It introduces low performance overheads, typically below 10 percent.