OS Support for Application Installation, Execution, and Management in an Untrustworthy World

在不可信的世界中对应用程序安装、执行和管理的操作系统支持

• 批准号: 0430477
• 负责人: Steven Gribble
• 金额: $ 45万
• 依托单位: University of Washington
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-09-15 至 2008-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0430477&HistoricalAwards=false
• 关键词: OS; Support; Application; Installation; Execution

Proposal Number: 0430477TItle: OS Support for Application Installation, Execution, and Management inan Untrustworthy WorldPI: Steven Gribble Modern computer users face many security threats and manageability obstacles. Today's software is increasingly complex, buggy, and prone to vulnerability. In addition to familiar threats such as worms and viruses, users must contend with new, more subtle attacks, such as the spread of spyware. Unfortunately, operating systems do little to help users address the security and vulnerability challenges of the networked environment. For example, it is difficult to determine what programs are running on a system, or what code is responsible for generating visible activity (such as network traffic, file system activity, or windowing activity). This research focuses on the construction of a new application and operating system architecture based on lightweight virtual machines, with each application being both installed and isolated in its own VM. Installing and removing applications becomes simple, as a VM provides a clean container in which all of the application dependencies and resources can be embedded. Tracking an application and associating activity with its source becomes possible, since activity is easily observable through and traceable to the narrow VM interface. This architecture provides stronger security properties, since malicious applications are isolated from benign programs and data, and a vulnerability within an application no longer puts other applications at risk. The impact of this work will be to provide users with trustworthy infrastructure that they can depend on, and to mitigate damage to users in the case of successful attacks.

提案编号：0430477标题：操作系统对应用程序安装、执行和管理的支持不可信的WorldPI：Steven Gribble现代计算机用户面临许多安全威胁和安全障碍。 今天的软件越来越复杂，漏洞越来越多，并且容易受到攻击。 除了蠕虫和病毒等常见威胁外，用户还必须应对新的、更微妙的攻击，如间谍软件的传播。 不幸的是，操作系统在帮助用户解决网络环境的安全性和脆弱性挑战方面做得很少。 例如，很难确定系统上运行的是什么程序，或者什么代码负责生成可见活动（如网络流量、文件系统活动或窗口活动）。本研究的重点是构建一个新的应用程序和操作系统架构的基础上轻量级虚拟机，每个应用程序都安装和隔离在自己的虚拟机。 安装和删除应用程序变得简单，因为VM提供了一个干净的容器，所有应用程序依赖项和资源都可以嵌入其中。 跟踪应用程序并将活动与其源相关联成为可能，因为活动可以通过窄VM接口轻松观察并跟踪到窄VM接口。 这种架构提供了更强的安全属性，因为恶意应用程序与良性程序和数据隔离，并且应用程序中的漏洞不再使其他应用程序处于危险之中。 这项工作的影响将是为用户提供他们可以依赖的值得信赖的基础设施，并在成功攻击的情况下减轻对用户的损害。