SBIR Phase I: Enabling Non-disruptive Updates in Order to Improve OS Security

SBIR 第一阶段：启用无中断更新以提高操作系统安全性

• 批准号: 0912531
• 负责人: Jeffrey Arnold
• 金额: $ 10万
• 依托单位: Ksplice, Inc.
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-07-01 至 2010-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0912531&HistoricalAwards=false
• 关键词: SBIR; Phase; Enabling; Non; disruptive

This Small Business Innovation Research Phase I project aims to demonstrate the feasibility of fundamental improvements to OS update technology. These improvements would allow system administrators to apply OS patches faster than current practice, which would significantly hinder botnets and other attackers by reducing the window of vulnerability during which systems are running software with known problems. The current state-of-the-art requires that computers reboot to apply kernel updates. Since rebooting is disruptive, many system administrators delay performing security updates, despite the greatly increased risk-more than 90% of attacks exploit known vulnerabilities. Security would improve if administrators could apply updates immediately, as hot updates, without the need for reboots or disruption. Although programmers have long been capable of making ad hoc modifications to running programs, hot update technology has not seen widespread use because of key technical problems. In particular, constructing hot updates has always required extensive programming effort, which is expensive and-since programmers make mistakes-risky.If successful, the current project will transform the state-of-the-art of software updates. Most directly, this research has the potential deliver a change that the IT industry wants: a way to apply security updates without rebooting. More generally, this research aims to improve the field's technical understanding of how to automatically apply traditional source code patches to a running program, such as the kernel. This problem has broad applications in debugging, profiling, instrumentation, and education. This research can lead to the creation of a hot update service, provided to companies on a per-machine, per-month basis, for a subscription charge. Companies who subscribe machines to this service would, without any ongoing effort, be able to transparently receive hot updates that solve software problems, without reboots or other disruption. This distribution of hot updates would improve security and reliability while decreasing machine maintenance costs.This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5).

这个小型企业创新研究第一阶段项目旨在证明操作系统更新技术的根本改进的可行性。这些改进将使系统管理员能够比目前的做法更快地应用操作系统补丁，这将通过减少系统运行具有已知问题的软件的漏洞窗口来显著阻止僵尸网络和其他攻击者。当前最先进的技术要求计算机重新启动以应用内核更新。由于重新启动是破坏性的，许多系统管理员延迟执行安全更新，尽管风险大大增加-超过90%的攻击利用已知的漏洞。如果管理员可以立即应用更新，作为热更新，而不需要重新启动或中断，安全性将得到改善。虽然程序员长期以来一直能够对运行中的程序进行特别修改，但由于关键技术问题，热更新技术尚未得到广泛使用。特别是，构建热更新总是需要大量的编程工作，这是昂贵的，而且由于程序员会犯错误，风险很大。如果成功的话，当前的项目将改变软件更新的现状。最直接的是，这项研究有可能带来IT行业想要的变化：一种在不重启的情况下应用安全更新的方法。更一般地说，这项研究旨在提高该领域对如何将传统源代码补丁自动应用于运行中的程序（如内核）的技术理解。这个问题在调试、分析、检测和教育中有广泛的应用。 这项研究可以导致创建一个热更新服务，提供给公司的每台机器，每月的基础上，订阅费。为机器订阅该服务的公司无需任何持续的努力，就能够透明地接收解决软件问题的热更新，而无需重新启动或其他中断。这种热更新的分发将提高安全性和可靠性，同时降低机器维护成本。该奖项根据2009年美国复苏和再投资法案（公法111-5）资助。