FlexOS: making OS isolation flexible
FlexOS: making OS isolation flexible
复制标题
FlexOS：使操作系统隔离变得灵活
DOI：
10.1145/3458336.3465292
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
C. Raiciu
中科院分区：
文献类型：
--
作者：
Hugo Lefeuvre;Vlad;Stefan Teodorescu;Pierre Olivier;Tiberiu Mosnoi;R. Deaconescu;Felipe Huici;C. Raiciu
传统上，操作系统设计与保护机制密切相关。操作系统静态地承诺（1）硬件隔离，（2）运行时检查，和（3）在设计时早期的软件验证中的一个或组合。部署后的更改需要进行重大重构;因此，它们很少且成本高昂。在本文中，我们认为，这种策略是不符合最近的硬件和软件的趋势：保护打破（熔毁），硬件成为异构（内存保护密钥，CHERI），和多个机制，现在可以用于相同的任务（软件加固，验证，硬件隔离等）。简而言之，隔离策略和原语的选择应该推迟到部署时。FlexOS是一种新颖的模块化操作系统设计，其划分和保护配置文件可以在构建时针对特定应用程序或用例进行无缝定制。FlexOS提供了一种语言来描述组件的安全需求/行为，并自动从中导出划分策略。我们实现了FlexOS的早期原型，它可以自动生成大量不同的操作系统，实现不同的安全策略。
OS design is traditionally heavily intertwined with protection mechanisms. OSes statically commit to one or a combination of (1) hardware isolation, (2) runtime checking, and (3) software verification early at design time. Changes after deployment require major refactoring; as such, they are rare and costly. In this paper, we argue that this strategy is at odds with recent hardware and software trends: protections break (Meltdown), hardware becomes heterogeneous (Memory Protection Keys, CHERI), and multiple mechanisms can now be used for the same task (software hardening, verification, HW isolation, etc). In short, the choice of isolation strategy and primitives should be postponed to deployment time. We present FlexOS, a novel, modular OS design whose compartmentalization and protection profile can seamlessly be tailored towards a specific application or use-case at build time. FlexOS offers a language to describe components' security needs/behavior, and to automatically derive from it a compartmentalization strategy. We implement an early proto-type of FlexOS that can automatically generate a large array of different OSes implementing different security strategies.
DOI：
--
发表时间：
2020
期刊：
--
影响因子：
--
作者：
Vikram Narayanan;Tianjiao Huang;David Detweiler;Daniel M. Appel;Zhaofeng Li;Gerd Zellweger;A. Burtsev
通讯作者：
Vikram Narayanan;Tianjiao Huang;David Detweiler;Daniel M. Appel;Zhaofeng Li;Gerd Zellweger;A. Burtsev