Loading...
Please wait, while we are loading the content...
Similar Documents
Fine-grained user-space security through virtualization (2011)
| Content Provider | CiteSeerX |
|---|---|
| Author | Gross, Thomas R. |
| Description | In VEE This paper presents an approach to the safe execution of applica-tions based on software-based fault isolation and policy-based sys-tem call authorization. A running application is encapsulated in an additional layer of protection using dynamic binary translation in user-space. This virtualization layer dynamically recompiles the machine code and adds multiple dynamic security guards that ver-ify the running code to protect and contain the application. The binary translation system redirects all system calls to a policy-based system call authorization framework. This interposi-tion framework validates every system call based on the given argu-ments and the location of the system call. Depending on the user-loadable policy and an extensible handler mechanism the frame-work decides whether a system call is allowed, rejected, or redirect to a specific user-space handler in the virtualization layer. This paper offers an in-depth analysis of the different security guarantees and a performance analysis of libdetox, a prototype of the full protection platform. The combination of software-based fault isolation and policy-based system call authorization imposes only low overhead and is therefore an attractive option to encapsu-late and sandbox applications to improve host security. |
| File Format | |
| Language | English |
| Publisher Date | 2011-01-01 |
| Access Restriction | Open |
| Content Type | Text |
| Resource Type | Article |
