One-way Isolation: An Effective Approach for Realizing Safe Execution Environments

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2005

Volumn , Issue , 2005, Pages

  Sun, Weiqing ^a   Liang, Zhenkai ^a   Sekar, R ^a   Venkatakrishnan, V N ^b  

^a Stony Brook University   (United States)

^b 1120 Science and Engineering Offices   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION PROGRAMS; NETWORK SECURITY; SOFTWARE TESTING;

CONSISTENCY CRITERIA; EFFECTIVE APPROACHES; EXECUTION ENVIRONMENTS; ISOLATION PROCESS; MALICIOUS CODES; PROPERTY; SOFTWARE CONFIGURATION; SOFTWARE PATCHES; SYSTEM CHANGE; WRITE OPERATIONS;

SEMANTICS;

EID: 84969564072     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (40)

1. A. Acharya and M. Raje. Mapbox: Using parameterized behavior classes to confine applications. In Proceedings of USENIX Security Symposium, 2000.
2. A. Brown and D. Patterson. Undo for operators: Building an undoable e-mail store. In Proceedings of USENIX Annual Technical Conference, 2003.
3. P. M. Chen and B. D. Nobl. When virtual is better than real. In Proceedings of Workshop on Hot Topics in Operating Systems, 2001.
4. T. Chiueh, H. Sankaran, and A. Neogi. Spout: A transparent distributed execution engine for java applets. In Proceedings of International Conference on Distributed Computing Systems, 2000.
5. S. Chutani, O. T. Anderson, M. L. Kazar, B. W. Leverett, W. A. Mason, and R. N. Sidebotham. The episode file system. In Proceedings of the USENIX Winter 1992 Technical Conference, 1992.
6. A. Dan, A. Mohindra, R. Ramaswami, and D. Sitaram. Chakravyuha: A sandbox operating system for the controlled execution of alien code. Technical report, IBM T.J. Watson research center, 1997.
7. I. Goldberg, D. Wagner, R. Thomas, and E. A. Brewer. A secure environment for untrusted helper applications: confining the wily hacker. In Proceedings of USENIX Security Symposium, 1996.
8. S. Jajodia, P. Liu, and C. D. McCollum. Application-level isolation to cope with malicious database users. In Proceedings of Annual Computer Security Applications Conference, 1998.
9. J. Katcher. Postmark: A new file system benchmark. Technical Report TR3022, Network Applicance Inc., 1997.
10. D. G. Korn and E. Krell. A new dimension for the unix file system. Software: Practice & Experience, 20(S1), 1990.
11. B. W. Lampson. A note on the confinement problem. Communications of the ACM, 16(10):613-615, 1973.
12. Z. Liang, V. Venkatakrishnan, and R. Sekar. Isolated program execution: An application transparent approach for executing untrusted programs. In Proceedings of Annual Computer Security Applications Conference, 2003.
13. P. Liu, S. Jajodia, and C. D. McCollum. Intrusion confinement by isolation in information systems. In Proceedings of IFIP Workshop on Database Security, 1999.
14. Loop back file system. Unix man page.
15. D. Malkhi and M. K. Reiter. Secure execution of java applets using a remote playground. Software Engineering, 26(12), 2000.
16. K.-K. Muniswamy-Reddy, C. P. Wright, A. P. Himmer, and E. Zadok. A versatile and user-oriented versioning file system. In Proceedings of USENIX Conference on File and Storage Technologies, 2004.
17. J.-S. Pendry and M. K. McKusick. Union mounts in 4.4bsd-lite. In Proceedings of 1995 USENIX Technical Conference on UNIX and Advanced Computing Systems, 1995.
18. J. S. Pendry, N. Williams, and E. Zadok. Am-utils user manual, 6.1b3 edition, july 2003. http://www.am-utils.org.
19. Z. Peterson and R. Burns. Ext3cow: The design, implementation, and analysis of metadata for a time-shifting file system. Technical Report. HSSL-2003-03, Hopkins Storage Systems Lab, Department of Computer Science, Johns Hopkins University, 2003.
20. D. Pilania and T. Chiueh. Design, implementation, and evaluation of an intrusion resilient database system. In Proceedings of International Conference on Dependable Systems and Networks, 2003.
21. V. Prevelakis and D. Spinellis. Sandboxing applications. In Proceedings of Usenix Annual Technical Conference: FREENIX Track, 2001.
22. N. Provos. Improving host security with system call policies. In Proceedings of USENIX Security Symposium, 2003.
23. S. Quinlan and S. Dorward. Venti: a new approach to archival storage. In Proceedings of USENIX Conference on File and Storage Technologies.
24. Recovery-oriented computing. http://roc.cs.berkeley.edu.
25. W. D. Roome. 3dfs: A time-oriented file server. In Proceedings of the USENIX Winter 1992 Technical Conference, 1991.
26. D. J. Santry, M. J. Feeley, N. C. Hutchinson, and A. C. Veitch. Elephant: The file system that never forgets. In Proceedings of Workshop on Hot Topics in Operating Systems, 1999.
27. K. Scott and J. Davidson. Safe virtual execution using software dynamic translation. In Proceedings of Annual Computer Security Applications Conference, 2002.
28. R. Sekar, Y. Cai, and M. Segal. A specification-based approach for building survivable systems. In Proceedings of National Information Systems Security Conference, Oct 1998.
29. R. Sekar and P. Uppuluri. Synthesizing fast intrusion prevention/detection systems from high-level specifications. In Proceedings of USENIX Security Symposium, 1999.
30. K. Sitaker. Picturepages software. http://www.canonical.org/picturepages/.
31. C. Soules, G. Goodson, J. Strunk, and G. Ganger. Metadata efficiency in a comprehensive versioning file system. In Proceedings of USENIX Conference on File and Storage Technologies, 2002.
32. Translucent file system, 1990. SunOS Reference Manual, Sun Microsystems.
33. T. Tiilikainen. Rename-them-all, linux freeware version. http://linux.iconet.com.br/system/preview/8622.html.
34. P. Uppuluri. Intrusion Detection/Prevention Using Behavior Specifications. PhD thesis, Stony Brook University, 2003.
35. Webstone, the benchmark for web servers. http://www.mindcraft.com/webstone.
36. A. Whitaker, M. Shaw, and S. Gribble. Denali: Lightweight virtual machines for distributed and networked applications. In Proceedings of USENIX Annual Technical Conference, 2002.
37. E. Zadok, I. Badulescu, and A. Shender. Extending file systems using stackable templates. In Proceedings of USENIX Annual Technical Conference, 1999.
38. M. Zalewski. Fakebust, a malicious code analyzer. http://www.derkeiler.com/MailingLists/securityfocus/bugtraq/2004-09/0251.html.
39. N. Zhu. Data versioning systems. Technical report, Stony Brook University, http://www.ecsl.cs.sunysb.edu/tech reports.html.
40. N. Zhu and T. Chiueh. Design, implementation, and evaluation of repairable file service. In Proceedings of International Conference on Dependable Systems and Networks, 2003.