II-EN: Enhancing Secure Virtual Architecture for Advanced Operating System Research

II-EN：增强高级操作系统研究的安全虚拟架构

• 批准号: 1629770
• 负责人: John Criswell
• 金额: $ 49.32万
• 依托单位: University of Rochester
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-08-01 至 2021-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1629770&HistoricalAwards=false
• 关键词: II; EN; Enhancing; Secure; Virtual

Commodity operating system kernels employ designs that are efficient but insecure. As a result, modern computing systems are insecure at their core. Fortunately, the Secure Virtual Architecture (SVA) infrastructure has allowed researchers to develop strong defenses for existing operating systems on existing hardware. This work seeks to improve SVA so that researchers can use it to develop defenses against increasingly sophisticated security attacks and build tools that evaluate the efficacy of those defenses.SVA is a compiler-based system that, to date, has been used to thwart memory safety errors and to protect applications running on a compromised operating system kernel. This research will make three primary enhancements to SVA to enable it to perform advanced security research. First will be to enhance SVA?s static analysis features to handle flexible and changing code generation and optimization techniques in existing compilers and to handle difficult-to-analyze source code constructs commonly used in operating system kernel code. Second, this work will enhance SVA?s ability to analyze operating system behavior at run-time via arbitrary metadata attached to memory objects. Finally, the plan is to enhance SVA to analyze machine code; this feature will enable SVA to be used in research on the efficacy of defenses against attacks.

商用操作系统内核采用高效但不安全的设计。 因此，现代计算系统在其核心是不安全的。 幸运的是，安全虚拟架构（SVA）基础设施允许研究人员在现有硬件上为现有操作系统开发强大的防御。 这项工作旨在改进SVA，使研究人员可以使用它来开发防御日益复杂的安全攻击，并建立工具，评估这些防御的有效性。SVA是一个基于编译器的系统，迄今为止，已被用来阻止内存安全错误，并保护在受损的操作系统内核上运行的应用程序。 这项研究将对SVA进行三项主要增强，使其能够进行高级安全研究。 首先是增强SVA？的静态分析功能，以处理现有编译器中灵活和不断变化的代码生成和优化技术，并处理操作系统内核代码中常用的难以分析的源代码结构。 第二，这项工作将提高SVA？通过附加到内存对象的任意元数据分析运行时操作系统行为的能力。 最后，计划是增强SVA分析机器代码的能力;这一功能将使SVA能够用于研究防御攻击的有效性。