NDLI: Process firewalls: protecting processes during resource access

Please wait, while we are loading the content...

TimeStream: reliable stream computation in the cloud

IFDB: decentralized information flow control for databases

ChainReaction: a causal+ consistent datastore based on chain replication

Conversion: multi-version concurrency control for main memory segments

Mizan: a system for dynamic load balancing in large-scale graph processing

RadixVM: scalable address spaces for multithreaded applications

Hypnos: understanding and treating sleep conflicts in smartphones

hClock: hierarchical QoS for packet scheduling in a hypervisor

Omega: flexible, scalable schedulers for large compute clusters

Optimus: a dynamic rewriting framework for data-parallel execution plans

Process firewalls: protecting processes during resource access

Augustus: scalable and robust storage for cloud applications

Whose cache line is it anyway?: operating system support for live detection and repair of false sharing

MeT: workload aware elasticity for NoSQL

Failure-atomic msync(): a simple and efficient mechanism for preserving the integrity of durable data

Prefetching mobile ads: can advertising systems afford it?

RapiLog: reducing system complexity through verification

Choosy: max-min fair sharing for datacenter jobs with constraints

BlinkDB: queries with bounded errors and bounded response times on very large data

Resolving the conflict between generality and plausibility in verified computation

MDCC: multi-data center consistency

Adaptive parallelism for web search

Presto: distributed machine learning and graph processing with sparse matrices

Composing OS extensions safely and efficiently with Bascule

Maygh: building a CDN from client web browsers

Application level ballooning for efficient server consolidation

$CPI^{2}:$ CPU performance isolation for shared compute clusters

A compiler-level intermediate representation based binary analysis and rewriting system

Process firewalls: protecting processes during resource access

Content Provider	ACM Digital Library
Author	Vijayakumar, Hayawardh Jaeger, Trent Schiffman, Joshua
Abstract	Processes retrieve a variety of resources from the operating system in order to execute properly, but adversaries have several ways to trick processes into retrieving resources of the adversaries' choosing. Such resource access attacks use name resolution, race conditions, and/or ambiguities regarding which resources are controlled by adversaries, accounting for 5-10% of CVE entries over the last four years. programmers have found these attacks extremely hard to eliminate because resources are managed externally to the program, but the operating system does not provide a sufficiently rich system-call API to enable programs to block such attacks. In this paper, we present the Process Firewall, a kernel mechanism that protects processes in manner akin to a network firewall for the system-call interface. Because the Process Firewall only protects processes -- rather than sandboxing them -- it can examine their internal state to identify the protection rules necessary to block many of these attacks without the need for program modification or user configuration. We built a prototype Process Firewall for Linux demonstrating: (1) the prevention of several vulnerabilities, including two that were previously-unknown; (2) that this defense can be provided system-wide for less than 4% overhead in a variety of macrobenchmarks; and (3) that it can also improve program performance, shown by Apache handling 3-8% more requests when program resource access checks are replaced by Process Firewall rules. These results show that it is practical for the operating system to protect processes by preventing a variety of resource access attacks system-wide.
Starting Page	57
Ending Page	70
Page Count	14
File Format	PDF
ISBN	9781450319942
DOI	10.1145/2465351.2465358
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2013-04-15
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Resource access attacks Protection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Process Firewalls: Protecting Processes During Resource Access

Process firewalls: protecting processes during resource access.

Policy models to protect resource retrieval

Protection methods against IP packet attacks

Controlled Virtual Resource Access to Mitigate Economic Denial of Sustainability (EDoS) Attacks against Cloud Infrastructures

Protecting Web servers from octopus attacks

Resiliency of open-source firewalls against remote discovery of last-matching rules

Protecting location privacy against inference attacks ( CCS '10 )

Protecting Privacy Credentials from Phishing and Spyware Attacks

Process firewalls: protecting processes during resource access

Similar Documents

Process Firewalls: Protecting Processes During Resource Access

Process firewalls: protecting processes during resource access.

Policy models to protect resource retrieval

Protection methods against IP packet attacks

Controlled Virtual Resource Access to Mitigate Economic Denial of Sustainability (EDoS) Attacks against Cloud Infrastructures

Protecting Web servers from octopus attacks

Resiliency of open-source firewalls against remote discovery of last-matching rules

Protecting location privacy against inference attacks ( CCS '10 )

Protecting Privacy Credentials from Phishing and Spyware Attacks

Process firewalls: protecting processes during resource access