TC: Small: Improving System Security through Virtual Layered File Systems

点击翻译按钮获取中文摘要

Desktop computers run many different applications, thecompromise of any one of which can compromise the entire desktop giventhe lack of isolation among applications. Recovering a compromiseddesktop remains a time consuming task, which typically requires wipingeverything and reinstalling the system from scratch. These security issues pose fundamental challenges as desktop computers arerelied on for everything from financial transactions tomedical records. To address these problems, we are creating novelvirtual layered file system (VLFS) technologies to improve system security. Unlike a traditional file system which is a monolithic entity, a VLFS dynamically composes together a set of software layersinto a single file system view for a desktop. Changes to one layerare isolated and decoupled from changes to another. The VLFS dynamiccomposition feature enables powerful and easy-to-use securityfunctionality. We are using VLFSes to build an architecture to enablesecurity patches to be deployed effectively when managing largenumbers of heterogeneously configured machines, and to speed systemrecovery from security exploits. We are also using VLFSes to developa transparent desktop application fault containment architecture thatis effective at limiting the damage from exploits to enable quickrecovery while being as easy to use as a traditional desktop system.The results of this proposal will provide a foundation for futurecomputer innovations to provide improved system security for users'systems. Because we are working with industry-standard operatingsystems and binary application and patch distributions, our resultswill be directly applicable to the commercial world.