One-Way Isolation: An Effective Approach for Realizing Safe Execution Environments

In this paper, we present an approach for realizing a safe execution environment (SEE) that enables users to “try out” new software (or configuration changes to existing software) without the fear of damaging the system in any manner. A key property of our SEE is that it faithfully reproduces the behavior of applications, as if they were running natively on the underlying host operating system. This is accomplished via one-way isolation: processes running within the SEE are given read-access to the environment provided by the host OS, but their write operations are prevented from escaping outside the SEE. As a result, SEE processes cannot impact the behavior of host OS processes, or the integrity of data on the host OS. Our SEE supports a wide range of tasks, including: study of malicious code, controlled execution of untrusted software, experimentation with software configuration changes, testing of software patches, and so on. It provides a convenient way for users to inspect ...

• Type: Conference
• Year: 2005
• Where: NDSS
• Authors: Weiqing Sun, Zhenkai Liang, V. N. Venkatakrishnan, R. Sekar
• Keywords: Computer Networks, Configuration Changes, Host Operating System, Host Os, NDSS 2005