SBIR Phase II: Enabling Non-disruptive Updates in Order to Improve OS Security

这个小企业创新研究（SBIR）第二阶段项目旨在改进操作系统更新技术。这些改进将允许系统管理员比目前的做法更快地应用操作系统补丁，这将通过减少系统运行具有已知问题的软件的漏洞窗口，大大阻碍僵尸网络和其他攻击者。当前最先进的技术要求计算机重新启动以应用内核更新。由于重新引导是中断的，许多系统管理员延迟执行安全更新。如果管理员可以立即应用更新（如热更新），而不需要重新启动或中断，安全性将得到提高。尽管程序员早就有能力对正在运行的程序进行特别的修改，但由于关键的技术问题，热更新技术并没有得到广泛的应用。特别是，构建热更新总是需要大量的编程工作，这既昂贵又有风险。如果成功，该项目将影响软件更新的最新技术。最直接的是，这项研究有可能带来IT行业想要的改变——一种不用重启就能应用安全更新的方法。更一般地说，这项研究旨在提高该领域对如何自动将传统源代码补丁应用于运行程序（如内核）的技术理解。这个问题在调试、分析、检测和教育方面有广泛的应用。这项研究可能会导致创建一个热更新服务，以每台机器、每月为基础，向公司提供订阅费用。订阅此服务的公司将无需任何持续的努力，就能够透明地接收解决软件问题的热更新，而无需重新启动或其他中断。这种热更新的分发将提高安全性和可靠性，同时降低机器维护成本。该产品在整个IT行业具有广泛吸引力的潜力。

This Small Business Innovation Research (SBIR) Phase II project aims to bring improvements to OS update technology. These improvements would allow system administrators to apply OS patches faster than current practice, which would significantly hinder botnets and other attackers by reducing the window of vulnerability during which systems are running software with known problems. The current state-of-the-art requires that computers reboot to apply kernel updates. Since rebooting is disruptive, many system administrators delay performing security updates. Security would improve if administrators could apply updates immediately, as hot updates, without the need for reboots or disruption. Although programmers have long been capable of making ad hoc modifications to running programs, hot update technology has not seen widespread use because of key technical problems. In particular, constructing hot updates has always required extensive programming effort, which is expensive and risky. If successful, this project will impact the state-of-the-art of software updates. Most directly, this research has the potential to deliver a change that the IT industry wants - a way to apply security updates without rebooting. More generally, this research aims to improve the field's technical understanding of how to automatically apply traditional source code patches to a running program, such as the kernel. This problem has broad applications in debugging, profiling, instrumentation, and education. This research can lead to the creation of a hot update service, provided to companies on a per-machine, per-month basis, for a subscription charge. Companies who subscribe machines to this service would, without any ongoing effort, be able to transparently receive hot updates that solve software problems, without reboots or other disruption. This distribution of hot updates would improve security and reliability while decreasing machine maintenance costs. This offering has the potential for wide appeal across the IT industry.