SBIR Phase I: Enabling Non-disruptive Updates in Order to Improve OS Security

该小型企业创新研究第一阶段项目旨在论证操作系统更新技术进行根本性改进的可行性。这些改进将允许系统管理员以比当前做法更快的速度应用操作系统补丁，这将通过缩短系统运行存在已知问题的软件的漏洞窗口，显著阻碍僵尸网络和其他攻击者。目前最先进的技术要求计算机重新启动才能应用内核更新。由于重启是破坏性的，许多系统管理员推迟执行安全更新，尽管风险大大增加-超过90%的攻击利用了已知的漏洞。如果管理员可以立即将更新作为热更新应用，而不需要重新启动或中断，则安全性将会提高。尽管程序员长期以来一直能够对正在运行的程序进行临时修改，但由于关键技术问题，热更新技术尚未得到广泛应用。特别是，构建热更新总是需要大量的编程工作，这是昂贵的，而且由于程序员犯错误，风险很大。如果成功，当前的项目将改变软件更新的最先进水平。最直接的是，这项研究有可能带来IT行业想要的变化：一种无需重启即可应用安全更新的方法。更广泛地说，这项研究旨在提高该领域对如何将传统源代码补丁自动应用于运行中的程序(如内核)的技术理解。这一问题在调试、剖析、仪器仪表和教育中有着广泛的应用。这项研究可以创建一种热门更新服务，按机器、按月向公司提供，并收取订阅费。为机器订阅这项服务的公司无需任何持续的努力，就可以透明地接收解决软件问题的热门更新，而不需要重新启动或其他中断。这种热门更新的分发将提高安全性和可靠性，同时降低机器维护成本。该奖项由2009年美国复苏和再投资法案(公共法律111-5)资助。

This Small Business Innovation Research Phase I project aims to demonstrate the feasibility of fundamental improvements to OS update technology. These improvements would allow system administrators to apply OS patches faster than current practice, which would significantly hinder botnets and other attackers by reducing the window of vulnerability during which systems are running software with known problems. The current state-of-the-art requires that computers reboot to apply kernel updates. Since rebooting is disruptive, many system administrators delay performing security updates, despite the greatly increased risk-more than 90% of attacks exploit known vulnerabilities. Security would improve if administrators could apply updates immediately, as hot updates, without the need for reboots or disruption. Although programmers have long been capable of making ad hoc modifications to running programs, hot update technology has not seen widespread use because of key technical problems. In particular, constructing hot updates has always required extensive programming effort, which is expensive and-since programmers make mistakes-risky.If successful, the current project will transform the state-of-the-art of software updates. Most directly, this research has the potential deliver a change that the IT industry wants: a way to apply security updates without rebooting. More generally, this research aims to improve the field's technical understanding of how to automatically apply traditional source code patches to a running program, such as the kernel. This problem has broad applications in debugging, profiling, instrumentation, and education. This research can lead to the creation of a hot update service, provided to companies on a per-machine, per-month basis, for a subscription charge. Companies who subscribe machines to this service would, without any ongoing effort, be able to transparently receive hot updates that solve software problems, without reboots or other disruption. This distribution of hot updates would improve security and reliability while decreasing machine maintenance costs.This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5).