CNS Core:Small:Revisiting Process Isolation with Compound Processes

CNS 核心：小：重新审视复合进程的进程隔离

• 批准号: 2210616
• 负责人: Jakob Eriksson
• 金额: $ 60万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2022
• 资助国家: 美国
• 起止时间: 2022-08-01 至 2025-07-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2210616&HistoricalAwards=false
• 关键词: CNS; Core; Small; Revisiting; Process

Modern computer software commonly consists of groups of programs executing together. This may be as simple as a web server and a database, or as complex as thousands of virtual machines, each running dozens of programs, all working together toward the same goal. Such groups of related programs are often started by a single user, who may even think of them as a single unit or "stack". Today, this common model of a stack of software, working toward a single goal on behalf of a single user is not reflected in the way the software actually executes. Instead, each individual layer of the stack is painstakingly guarded against incursion by other layers, through a mechanism called process isolation. What is more, many modern stacks consist of groups of virtual machines (VMs), where an additional layer of safeguards is imposed between VMs, often resulting in high overheads and low efficiency. This project introduces a new concept, a "compound process" which better reflects the realities of modern software. A compound process may host several "guest" programs in a single trust domain, eliminating expensive and often redundant safeguards between components of a single software stack, to yield substantial performance benefits. The project will proceed along three main thrusts: (a) a basic compound process loader and support libraries, allowing the user to run arbitrary combinations of programs (guests) as threads in a single compound process, (b) runtime supports for individual guests sharing a single thread, allowing further efficiency improvements, and (c) automatically running all of the processes of an entire a virtual machine as guests within a single compound process. By improving the efficiency of execution of popularly used software stacks, this project aims to reduce the equipment needs and increase the energy efficiency of the software that runs the modern world. Beyond direct research impact, experience from the project will both enrich the computer systems curriculum and provide research opportunities to both undergraduates students at UIC, a Minority (MSI), Asian American and Pacific Islander (AANAPISI) and Hispanic (HSI) Serving Institution.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

现代计算机软件通常由一起执行的程序组组成。这可能像Web服务器和数据库一样简单，也可能像数千个虚拟机一样复杂，每个虚拟机运行数十个程序，所有程序都朝着同一个目标共同工作。这些相关程序组通常由单个用户启动，用户甚至可以将它们视为单个单元或“堆栈”。今天，这种代表单个用户朝着单个目标工作的软件堆栈的常见模型并没有反映在软件实际执行的方式中。相反，通过一种称为进程隔离的机制，堆栈的每一层都被精心保护，以防止其他层的入侵。更重要的是，许多现代堆栈由虚拟机（VM）组组成，其中在VM之间施加额外的保护层，通常导致高开销和低效率。这个项目引入了一个新的概念，一个“复合过程”，它更好地反映了现代软件的现实。复合进程可以在单个信任域中托管多个“访客”程序，从而消除单个软件栈的组件之间的昂贵且通常冗余的保护措施，以产生实质性的性能益处。该项目将沿着三个主要方向进行：（a）基本复合进程加载器和支持库，允许用户在单个复合进程中作为线程运行程序（访客）的任意组合，（B）对共享单个线程的各个访客的运行时支持，允许进一步的效率改进，以及（c）在单个复合进程内自动地将整个虚拟机的所有进程作为访客运行。通过提高常用软件栈的执行效率，该项目旨在减少设备需求并提高运行现代世界的软件的能源效率。除了直接的研究影响，该项目的经验将丰富计算机系统课程，并提供研究机会，以本科生在UIC，少数民族（MSI），亚裔美国人和太平洋岛民（AANAPISI）和西班牙裔（HSI）服务机构。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查进行评估，被认为值得支持的搜索.