μSCOPE: A Methodology for Analyzing Least-Privilege Compartmentalization in Large Software Artifacts
μSCOPE: A Methodology for Analyzing Least-Privilege Compartmentalization in Large Software Artifacts
复制标题
DOI：
10.1145/3471621.3471839
复制
发表时间：
2021-10
期刊：
影响因子：
--
通讯作者：
Nick Roessler;Lucas Atayde;I. Palmer;D. McKee;J. Pandey;V. Kemerlis;Mathias Payer;Adam Bates;Jonathan M. Smith;A. DeHon;Nathan Dautenhahn
中科院分区：
文献类型：
--
作者：
Nick Roessler;Lucas Atayde;I. Palmer;D. McKee;J. Pandey;V. Kemerlis;Mathias Payer;Adam Bates;Jonathan M. Smith;A. DeHon;Nathan Dautenhahn
由于优先考虑简单性和可移植性，最小权限工程在操作系统设计中一直被忽视，导致了单片内核的出现，其中任何漏洞利用都会导致完全的妥协。μSCOPE（“显微镜”）通过自动识别最小权限分离的机会来解决这个问题。μSCOPE采用一种定量和系统的权限分析方法，用一种通用的方法来探索安全性与性能设计点的连续统一体，从而取代了专家驱动的半自动化分析。我们通过以下方式将μSCOPE方法应用于Linux内核：（1）对整个内核进行检测，以获得全面的、细粒度的内存访问和调用活动；（2）将这些访问映射到语义信息；（3）使用定量权限和开销指标对内核进行可分离性分析。我们发现了大幅降低权限的机会，同时预测到相对较低的开销——在15%的调解开销下，Linux中的过度权限可降低多达99.8%——这表明细粒度的权限分离是可行的，并为加速实际的权限分离奠定了基础。
By prioritizing simplicity and portability, least-privilege engineering has been an afterthought in OS design, resulting in monolithic kernels where any exploit leads to total compromise. μSCOPE (“microscope”) addresses this problem by automatically identifying opportunities for least-privilege separation. μSCOPE replaces expert-driven, semi-automated analysis with a general methodology for exploring a continuum of security vs. performance design points by adopting a quantitative and systematic approach to privilege analysis. We apply the μSCOPE methodology to the Linux kernel by (1) instrumenting the entire kernel to gain comprehensive, fine-grained memory access and call activity; (2) mapping these accesses to semantic information; and (3) conducting separability analysis on the kernel using both quantitative privilege and overhead metrics. We discover opportunities for orders of magnitude privilege reduction while predicting relatively low overheads—at 15% mediation overhead, overprivilege in Linux can be reduced up to 99.8%—suggesting fine-grained privilege separation is feasible and laying the groundwork for accelerating real privilege separation.