TWC: Medium: Collaborative: Trustworthy Programs Without A Trustworthy Operating System

操作系统(OS)对应用程序实行完全控制，因此OS的妥协会危及每个应用程序。面对系统危害，软件开发人员几乎没有办法提高安全性-他们无法防御操作系统漏洞，也无法合理地替换构成现代操作系统的数百万行代码的安全版本。与要求应用程序盲目信任操作系统交互不同，本项目研究的系统体系结构使受信任的应用程序能够在小型、可信的管理程序的帮助下高效地验证操作系统交互。大多数验证工作是在C语言运行时执行的，最大限度地减少了对遗留代码的更改，并避免了开发人员增加编程复杂性。原型系统名为InkTag，在几个关键领域改进了以前的工作：它提供了更高效的技术来验证系统调用结果，对由不可信的操作系统管理的资源实施了可用的访问控制，并引入了硬件和软件技术来进一步缩小可信计算基础的规模。云计算提供了能源和经济效率，但无法为托管应用程序提供有意义的安全保证。该项目展示了在不信任操作系统的情况下，系统安全是可能的-托管基础设施的一大部分。该项目还在为本科生和研究生课程开发新的材料，将系统的核心知识与对系统如何提供安全属性的理解结合起来，使未来的计算机专业人员更好地了解系统可以提供哪些有意义的安全保障。

The operating system (OS) exercises complete control over applications, thus a compromise of the OS compromises every application. Software developers have little recourse to improve security in the face of system compromise---they cannot defend against OS vulnerabilities, nor can they reasonably substitute a secure version of the millions of lines of code that constitute a modern OS.Rather than require applications to blindly trust OS interactions, this project investigates a system architecture that enables trusted applications to efficiently verify OS interactions with the help of a small, trusted hypervisor. Most verification work is performed within the C language runtime, minimizing changes to legacy code and shielding developers from increased programming complexity.The prototype system, called InkTag,improves upon prior work in several key areas: it provides more efficient techniques to verify system call results, implements usable access control for resources managed by an untrusted OS, and introduces hardware and software techniques to further reduce the size of the trusted computing base.Cloud computing provides energy and economic efficiencies, but suffers from the inability to give meaningful security guarantees to hosted applications. This project demonstrates that system security is possible without trusting the OS---a large part of the hosted infrastructure. This project is also developing new materials for undergraduate and graduate curricula that combine core knowledge of systems with an understanding of how systems provide security properties, equipping future computer professionals with a better understanding of what security guarantees a system can meaningfully provide.