A Study of Security Isolation Techniques

Abstract

Security isolation is a foundation of computing systems that enables resilience to different forms of attacks. This article seeks to understand existing security isolation techniques by systematically classifying different approaches and analyzing their properties. We provide a hierarchical classification structure for grouping different security isolation techniques. At the top level, we consider two principal aspects: mechanism and policy. Each aspect is broken down into salient dimensions that describe key properties. We break the mechanism into two dimensions, enforcement location and isolation granularity, and break the policy aspect down into three dimensions: policy generation, policy configurability, and policy lifetime. We apply our classification to a set of representative articles that cover a breadth of security isolation techniques and discuss tradeoffs among different design choices and limitations of existing approaches.

References

1. Anurag Acharya and Mandar Raje. 2000. MAPbox: Using parameterized behavior classes to confine untrusted applications. In Proceedings of the 9th Conference on USENIX Security Symposium-Volume 9. USENIX Association, 1--1.
2. AMD64. 2005. Secure virtual machine architecture reference manual. AMD Publication 33047 (2005).
3. Glenn Ammons, Jonathan Appavoo, Maria Butrico, Dilma Da Silva, David Grove, Kiyokuni Kawachiya, Orran Krieger, Bryan Rosenburg, Eric Van Hensbergen, and Robert W. Wisniewski. 2007. Libra: A library operating system for a jvm in a virtualized execution environment. In Proceedings of the 3rd International Conference on Virtual Execution Environments. ACM, 44--54.
4. J. P. Anderson. 1972. Computer Security Technology Planning Study. ESDTR-73-51. Air Force Electronic Systems Division, Hanscom AFB, Bedford, MA. (Also available as Vol. I, DITCAD-758206. Vol. II DITCAD-772806).
5. Apple Inc. 2015. System Integrity Protection Guide. Retrieved from https://developer.apple.com/library/mac/documentation/Security/Conceptual/System_Integrity_Protection_Guide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40016462-CH1-DontLinkElementID_15.
6. Ahmed M. Azab, Peng Ning, and Xiaolan Zhang. 2011. Sice: A hardware-level strongly isolated computing environment for x86 multi-core platforms. In Proceedings of the 18th ACM Conference on Computer and Communications Security. ACM, 375--388.
7. Michael Backes, Sven Bugiel, Christian Hammer, Oliver Schranz, and Philipp von Styp-Rekowsky. 2015. Boxify: Full-fledged app sandboxing for stock android. In Proceedings of the 24th USENIX Security Symposium (USENIX Security 15). 691--706.
8. Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, and Andrew Warfield. 2003. Xen and the art of virtualization. ACM SIGOPS Operat. Syst. Rev. 37, 5 (2003), 164--177.
9. Andrew Baumann, Dongyoon Lee, Pedro Fonseca, Lisa Glendenning, Jacob R. Lorch, Barry Bond, Reuben Olinsky, and Galen C. Hunt. 2013. Composing OS extensions safely and efficiently with Bascule. In Proceedings of the 8th ACM European Conference on Computer Systems. ACM, 239--252.
10. Andrew Baumann, Marcus Peinado, and Galen Hunt. 2014. Shielding applications from an untrusted cloud with haven. In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI).
11. Fabrice Bellard. 2005. QEMU, a fast and portable dynamic translator. In Proceedings of the USENIX Annual Technical Conference, FREENIX Track. 41--46.
12. Muli Ben-Yehuda, Michael D. Day, Zvi Dubitzky, Michael Factor, Nadav Har’El, Abel Gordon, Anthony Liguori, Orit Wasserman, and Ben-Ami Yassour. 2010. The turtles project: Design and implementation of nested virtualization. In OSDI, Vol. 10. 423--436.
13. Brian N. Bershad, Stefan Savage, Przemyslaw Pardyak, Emin Gün Sirer, Marc E. Fiuczynski, David Becker, Craig Chambers, and Susan Eggers. 1995. Extensibility Safety and Performance in the SPIN Operating System. Vol. 29. ACM.
14. Luca Cardelli, Jim Donahue, Mick Jordan, Bill Kalsow, and Greg Nelson. 1989. The modula--3 type system. In Proceedings of the 16th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. ACM, 202--212.
15. Benjie Chen and Robert Morris. 2003. Certifying program execution with secure processors. In HotOS. 133--138.
16. Haibo Chen, Fengzhe Zhang, Cheng Chen, Ziye Yang, Rong Chen, Binyu Zang, and Wenbo Mao. 2007. Tamper-resistant execution in an untrusted operating system using a virtual machine monitor.
17. Xiaoxin Chen, Tal Garfinkel, E. Christopher Lewis, Pratap Subrahmanyam, Carl A. Waldspurger, Dan Boneh, Jeffrey Dwoskin, and Dan R. K. Ports. 2008. Overshadow: A virtualization-based approach to retrofitting protection in commodity operating systems. In ACM SIGOPS Operating Systems Review, Vol. 42. ACM, 2--13.
18. Yueqiang Cheng, Xuhua Ding, and R. Deng. 2013. Appshield: Protecting applications against untrusted operating system. Singaport Management University Technical Report, SMU-SIS-13 101 (2013).
19. Chris Clayton. 2013. Understanding Application Domains. Retrieved from https://blogs.msdn.microsoft.com/cclayton/2013/05/21/understanding-application-domains/. (2013).
20. Patrick Colp, Mihir Nanavati, Jun Zhu, William Aiello, George Coker, Tim Deegan, Peter Loscocco, and Andrew Warfield. 2011. Breaking up is hard to do: Security and functionality in a commodity hypervisor. In Proceedings of the 23rd ACM Symposium on Operating Systems Principles. ACM, 189--202.
21. Fernando J. Corbató and Victor A. Vyssotsky. 1965. Introduction and overview of the Multics system. In Proceedings of the November 30--December 1, 1965, Fall Joint Computer Conference, Part I. ACM, 185--196.
22. Jonathan Corbet. 2009. Seccomp and sandboxing. LWN.net, May (2009).
23. Cristina Cornes, Judicaël Courant, Jean-Christophe Filliâtre, Gérard Huet, Pascal Manoury, Christine Paulin-Mohring, César Munoz, Chetan Murthy, Catherine Parent, Amokrane Saibi, and others. 1995. The Coq Proof Assistant Reference Manual, Version 5.10. Technical Report. INRIA, France. Research Report, RT-0177, inria-00069994.
24. K. Crary, Neal Glew, Dan Grossman, Richard Samuels, F. Smith, D. Walker, S. Weirich, and S. Zdancewic. 1999. TALx86: A realistic typed assembly language. In Proeedings of the 1999 ACM SIGPLAN Workshop on Compiler Support for System Software. 25--35.
25. Dorothey E. Denning. 1976. A lattice model of secure information flow. Commun. ACM 19, 5 (May 1976).
26. Jeff Dike and others. 2001. User mode linux. (2001).
27. Alan M. Dunn, Michael Z. Lee, Suman Jana, Sangman Kim, Mark Silberstein, Yuanzhong Xu, Vitaly Shmatikov, and Emmett Witchel. 2012. Eternal sunshine of the spotless machine: Protecting privacy with ephemeral channels. In Presented as Part of the 10th USENIX Symposium on Operating Systems Design and Implementation (OSDI 12). 61--75.
28. William Enck, Machigar Ongtang, and Patrick McDaniel. 2009. Understanding android security. IEEE Sec. Priv. 1 (2009), 50--57.
29. Dawson R. Engler, M. Frans Kaashoek, and others. 1995. Exokernel: An Operating System Architecture for Application-level Resource Management. Vol. 29. ACM.
30. Ulfar Erlingsson. 2003. The Inlined Reference Monitor Approach to Security Policy Enforcement. Technical Report. Cornell University.
31. Bryan Ford and Russ Cox. 2008. Vx32: Lightweight user-level sandboxing on the x86. In USENIX Annual Technical Conference. Boston, MA, 293--306.
32. Bryan Ford, Mike Hibler, Jay Lepreau, Patrick Tullmann, Godmar Back, and Stephen Clawson. 1996. Microkernels meet recursive virtual machines. In OSDI, Vol. 96. 137--151.
33. Bill Frantz. 1988. KeyKOS-asecure, high-performanceenvironmentforS/370. In Proc. of SHARE 70 (1988), 465--471.
34. Tal Garfinkel, Ben Pfaff, Jim Chow, Mendel Rosenblum, and Dan Boneh. 2003. Terra: A virtual machine-based platform for trusted computing. In ACM SIGOPS Operating Systems Review, Vol. 37. ACM, 193--206.
35. Daniel B. Giffin, Amit Levy, Deian Stefan, David Terei, David Mazieres, John C. Mitchell, and Alejandro Russo. 2012. Hails: Protecting data privacy in untrusted web applications. In OSDI. 47--60.
36. William R. Harris, Somesh Jha, and Thomas Reps. 2010. DIFC programs by automatic instrumentation. In Proceedings of the 17th ACM Conference on Computer and Communications Security. ACM, 284--296.
37. William R. Harris, Nicholas A. Kidd, Sagar Chaki, Somesh Jha, and Thomas Reps. 2009. Verifying information flow control over unbounded processes. In FM 2009: Formal Methods. Springer, 773--789.
38. Chris Hawblitzel, Jon Howell, Jacob R. Lorch, Arjun Narayan, Bryan Parno, Danfeng Zhang, and Brian Zill. 2014. Ironclad apps: End-to-end security via automated full-system verification. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14). 165--181.
39. Matt Helsley. 2009. LXC: Linux container tools. IBM devloperWorks Technical Library (2009).
40. Boniface Hicks, Sandra Rueda, Trent Jaeger, and Patrick Drew McDaniel. 2007. From trusted to secure: Building and executing applications that enforce system security. In Proceedings of the USENIX Annual Technical Conference, Vol. 7. 34.
41. Tsung-Hsuan Ho, Daniel Dean, Xiaohui Gu, and William Enck. 2014. PREC: Practical root exploit containment for android devices. In Proceedings of the 4th ACM Conference on Data and Application Security and Privacy. ACM, 187--198.
42. Owen S. Hofmann, Sangman Kim, Alan M. Dunn, Michael Z. Lee, and Emmett Witchel. 2013. Inktag: Secure applications on an untrusted operating system. ACM SIGPLAN Not. 48, 4 (2013), 265--278.
43. Gerard J. Holzmann. 1997. The model checker SPIN. IEEE Trans. Softw. Eng. 23, 5 (1997), 279--295.
44. Jon Howell, Bryan Parno, and John R. Douceur. 2013. Embassies: Radically refactoring the web. In NSDI. 529--545.
45. Galen Hunt, Mark Aiken, Manuel Fähndrich, Chris Hawblitzel, Orion Hodson, James Larus, Steven Levi, Bjarne Steensgaard, David Tarditi, and Ted Wobber. 2007. Sealing OS processes to improve dependability and safety. In ACM SIGOPS Operating Systems Review, Vol. 41. ACM, 341--354.
46. Galen C. Hunt and James R. Larus. 2007. Singularity: Rethinking the software stack. ACM SIGOPS Operating Systems Review 41, 2 (2007), 37--49.
47. Intel. 2007. Intel Trusted Execution Technology. Retrieved from http://www.intel.com/content/www/us/en/architecture-and-technology/trusted-execution-technology/trusted-execution-technology-security-paper.html. (2007).
48. Bhushan Jain, Chia-Che Tsai, Jitin John, and Donald E. Porter. 2014. Practical techniques to obviate setuid-to-root binaries. In Proceedings of the 9th European Conference on Computer Systems (EuroSys’14). ACM, New York, NY,, Article 8, 14 pages. DOI:http://dx.doi.org/10.1145/2592798.2592811
49. Suman Jana, Donald E. Porter, and Vitaly Shmatikov. 2011. TxBox: Building secure, officient sandboxes with system transactions. In Proceedings of the 2011 IEEE Symposium on Security and Privacy (SP). IEEE, 329--344.
50. Håvard D. Johansen, Eleanor Birrell, Robbert van Renesse, Fred B. Schneider, Magnus Stenhaug, and Dag Johansen. 2015. Enforcing privacy policies with meta-code. In Proceedings of the 6th Asia-Pacific Workshop on Systems (APSys’15). Article 16. DOI:http://dx.doi.org/10.1145/2797022.2797040
51. Poul-Henning Kamp and Robert N. M. Watson. 2000. Jails: Confining the omnipotent root. In Proceedings of the 2nd International SANE Conference, Vol. 43. 116.
52. Taesoo Kim and Nickolai Zeldovich. 2013. Practical and effective sandboxing for non-root users. In Presented as Part of the 2013 USENIX Annual Technical Conference. USENIX, 139--144.
53. Vladimir Kiriansky, Derek Bruening, and Saman P. Amarasinghe. 2002. Secure execution via program shepherding. In Proceedings of the USENIX Security Symposium, Vol. 92.
54. Gerwin Klein, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, and others. 2009. seL4: Formal verification of an OS kernel. In Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles. ACM, 207--220.
55. Kirill Kolyshkin. 2006. Virtualization in linux. White Paper, OpenVZ (2006).
56. Maxwell Krohn and Eran Tromer. 2009. Noninterference for a practical DIFC-based operating system. In Proceedings of the IEEE Symposium on Security and Privacy. 61--76.
57. Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. 2007. Information flow control for standard OS abstractions. In Proceedings of ACM Symposium on Operating Systems Principles (SOSP). 321--334.
58. Yanlin Li, J. M. McCune, James Newsome, Adrian Perrig, Brandon Baker, and Will Drewry. 2014. MiniBox: A two-way sandbox for x86 native code. In Proceedings of the 2014 USENIX Annual Technical Conference.
59. Jed Liu, Michael D. George, Krishnaprasad Vikram, Xin Qi, Lucas Waye, and Andrew C. Myers. 2009. Fabric: A platform for secure distributed computation and storage. In Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles. ACM, 321--334.
60. Lanyue Lu, Yupu Zhang, Thanh Do, Samer Al-Kiswany, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau. 2014. Physical disentanglement in a container-based file system. In Proceedings of the 11th USENIX Conference on Operating Systems Design and Implementation. USENIX Association, 81--96.
61. Anil Madhavapeddy, Richard Mortier, Charalampos Rotsos, David Scott, Balraj Singh, Thomas Gazagnaire, Steven Smith, Steven Hand, and Jon Crowcroft. 2013. Unikernels: Library operating systems for the cloud. In ACM SIGPLAN Notices, Vol. 48. ACM, 461--472.
62. Stephen McCamant and Greg Morrisett. 2006. Evaluating SFI for a CISC architecture. In Usenix Security. 15.
63. Steven McCanne and Van Jacobson. 1993. The BSD packet filter: A new architecture for user-level packet capture. In Proceedings of the USENIX Winter 1993 Conference Proceedings on USENIX Winter 1993 Conference Proceedings. USENIX Association, 2--2.
64. Jonathan M. McCune, Yanlin Li, Ning Qu, Zongwei Zhou, Anupam Datta, Virgil Gligor, and Adrian Perrig. 2010. TrustVisor: Efficient TCB reduction and attestation. In Proceedings of the 2010 IEEE Symposium on Security and Privacy (SP). IEEE, 143--158.
65. Jonathan M. McCune, Bryan Parno, Adrian Perrig, Michael K. Reiter, and Arvind Seshadri. 2007. Minimal TCB code execution. In Proceedings of the IEEE Symposium on Security and Privacy, 2007. SP’07. IEEE, 267--272.
66. Jonathan M. McCune, Bryan J. Parno, Adrian Perrig, Michael K. Reiter, and Hiroshi Isozaki. 2008. Flicker: An execution infrastructure for TCB minimization. In ACM SIGOPS Operating Systems Review, Vol. 42. ACM, 315--328.
67. Frank McKeen, Ilya Alexandrovich, Alex Berenzon, Carlos V. Rozas, Hisham Shafi, Vedvyas Shanbhogue, and Uday R. Savagaonkar. 2013. Innovative instructions and software model for isolated execution. In Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Privacy. ACM, 1--1.
68. Paul Menage. 2004. Control Groups. Retrieved from https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt. (2004).
69. Dirk Merkel. 2014. Docker: Lightweight Linux containers for consistent development and deployment. Linux J. 2014, 239 (2014), 2.
70. James Mickens. 2014. Pivot: Fast, synchronous mashup isolation using generator chains. In Proceedings of the 2014 IEEE Symposium on Security and Privacy (SP). IEEE, 261--275.
71. Charlie Miller, Dion Blazakis, Dino DaiZovi, Stefan Esser, Vincenzo Iozzo, and Ralf-Philip Weinmann. 2012. iOS Hacker’s Handbook. John Wiley 8 Sons.
72. Mark S. Miller, Mike Samuel, Ben Laurie, Ihab Awad, and Mike Stay. 2008. Safe Active Content in Sanitized JavaScript. Technical Report. Google, Inc.
73. MSDN. 2012. Understanding Enhanced Protection Mode. Retrieved from http://blogs.msdn.com/b/ieinternals/archive/2012/03/23/understanding-ie10-enhanced-protected-mode-network-security-addons-cookies-metro-desktop.aspx. (2012).
74. Adwait Nadkarni and William Enck. 2013. Preventing accidental data disclosure in modern operating systems. In Proceedings of the 2013 ACM SIGSAC Conference on Computer 8 Communications Security. 1029--1042.
75. National Security Agency. 2009. Security-Enhanced Linux (SELinux). Retrieved from http://www.nsa.gov/research/selinux. (2009).
76. George C. Necula. 1998. Compiling with Proofs. Technical Report. DTIC Document.
77. George C. Necula and Peter Lee. 1998. The design and implementation of a certifying compiler. In Proceedings of the ACM SIGPLAN 1998 Conference on Programming Language Design and Implementation (PLDI’98). 333--344.
78. David M. Nicol, William H. Sanders, William L. Scherlis, and Laurie A. Williams. 2012. Science of Security Hard Problems: A Lablet Perspective. Science of Security Virtual Organization Web. (Nov. 2012).
79. Kaan Onarlioglu, Collin Mulliner, William Robertson, and Engin Kirda. 2013. Privexec: Private execution as an operating system service. In Proceedings of the 2013 IEEE Symposium on Security and Privacy (SP). IEEE, 206--220.
80. Parveen Patel, Andrew Whitaker, David Wetherall, Jay Lepreau, and Tim Stack. 2003. Upgrading transport protocols using untrusted mobile code. In ACM SIGOPS Operating Systems Review, Vol. 37. ACM, 1--14.
81. Paul Pearce, Adrienne Porter Felt, Gabriel Nunez, and David Wagner. 2012. Addroid: Privilege separation for applications and advertisers in android. In Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security. ACM, 71--72.
82. Phu H. Phung and Lieven Desmet. 2012. A two-tier sandbox architecture for untrusted JavaScript. In Proceedings of the Workshop on JavaScript Tools. ACM, 1--10.
83. R. Pike, D. Presotto, K. Thompson, and H. Trickey. 1990. Plan 9 from bell labs. In Proceedings of the UKUUG Conference. London, UK, 1--9.
84. Joe Gibbs Politz, Spiridon Aristides Eliopoulos, Arjun Guha, and Shriram Krishnamurthi. 2011. ADsafety: Type-based verification of JavaScript sandboxing. In Proceedings of the 20th USENIX Conference on Security. Usenix Association, 12--12.
85. Donald E. Porter, Silas Boyd-Wickizer, Jon Howell, Reuben Olinsky, and Galen C. Hunt. 2011. Rethinking the library OS from the top down. ACM SIGPLAN Not. 46, 3 (2011), 291--304.
86. Shaya Potter, Jason Nieh, and Matt Selsky. 2007. Secure isolation of untrusted legacy applications. In LISA, Vol. 7. 1--14.
87. Niels Provos. 2003. Improving host security with system call policies. In USENIX Security, Vol. 3.
88. Mohan Rajagopalan, Matti A. Hiltunen, Trevor Jim, and Richard D. Schlichting. 2006. System call monitoring using authenticated system calls. IEEE Trans. Depend. Sec. Comput. 3, 3 (2006), 216--229.
89. Thomas Ristenpart, Eran Tromer, Hovav Shacham, and Stefan Savage. 2009. Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds. In Proceedings of the 16th ACM Conference on Computer and Communications Security. ACM, 199--212.
90. Dan Rosenberg. 2014. Qsee trustzone kernel integer over flow vulnerability. In Black Hat Conference.
91. Joanna Rutkowska. 2012. Introducing Qubes 1.0. Retrieved from http://theinvisiblethings.blogspot.com/2012/09/introducing-qubes-10.html. (2012).
92. Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Ronald Perez, Leendert Van Doorn, John Linwood Griffin, Stefan Berger, Reiner Sailer, Enriquillo Valdez, Trent Jaeger, and others. 2005. sHype: Secure hypervisor approach to trusted virtualized systems. Technical Report RC23511 (2005).
93. Jerry Saltzer and Mike Schroeder. 1975. The protection of information in computer systems. Proc. IEEE 63, 9 (Sep. 1975).
94. Nuno Santos, Rodrigo Rodrigues, and Bryan Ford. 2012. Enhancing the OS against security threats in system administration. In Middleware 2012. Springer, 415--435.
95. Fred B. Schneider. 2000. Enforceable security policies. ACM Trans. Inf. Syst. Secur. 3, 1 (Feb. 2000), 30--50. DOI:http://dx.doi.org/10.1145/353323.353382
96. Fred B. Schneider, Greg Morrisett, and Robert Harper. 2001. A language-based approach to security. In Informatics. Springer, 86--101.
97. Zhiyong Shan, Xin Wang, Tzi-cker Chiueh, and Xiaofeng Meng. 2012. Facilitating inter-application interactions for os-level virtualization. In ACM SIGPLAN Notices, Vol. 47. ACM, 75--86.
98. Jonathan S. Shapiro, Jonathan M. Smith, and David J. Farber. 1999. EROS: A fast capability system. In Proceedings of the 17th ACM Symposium on Operating Systems Principles (SOSP’99). ACM, New York, NY, 170--185. DOI:http://dx.doi.org/10.1145/319151.319163
99. Shashi Shekhar, Michael Dietz, and Dan S. Wallach. 2012. AdSplit: Separating smartphone advertising from applications. In USENIX Security Symposium. 553--567.
100. Lenin Singaravelu, Calton Pu, Hermann Härtig, and Christian Helmuth. 2006. Reducing TCB complexity for security-sensitive applications: Three case studies. ACM SIGOPS Operat. Syst. Rev. 40, 4 (2006), 161--174.
101. Christopher Small. 1997. A tool for constructing safe extensible C++ systems. In Proceedings of the 3rd USENIX Conference on Object-Oriented Technologies and Systems. 175--184.
102. Stephen Soltesz, Herbert Pötzl, Marc E. Fiuczynski, Andy Bavier, and Larry Peterson. 2007. Container-based operating system virtualization: A scalable, high-performance alternative to hypervisors. In ACM SIGOPS Operating Systems Review, Vol. 41. ACM, 275--287.
103. Deian Stefan, Alejandro Russo, Pablo Buiras, Amit Levy, John C. Mitchell, and David Mazieres. 2012. Addressing covert termination and timing channels in concurrent information flow systems. In ACM SIGPLAN Notices, Vol. 47. ACM, 201--214.
104. Deian Stefan, Edward Z. Yang, Petr Marchenko, Alejandro Russo, Dave Herman, Brad Karp, and David Mazieres. 2014. Protecting users by confining JavaScript with COWL. In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI’14).
105. Marc Stiegler, Alan H. Karp, Ka-Ping Yee, Tyler Close, and Mark S. Miller. 2006. Polaris: Virus-safe computing for windows XP. Commun. ACM 49, 9 (2006), 83--88.
106. Richard Ta-Min, Lionel Litty, and David Lie. 2006. Splitting interfaces: Making trust between applications and operating systems configurable. In Proceedings of the 7th Symposium on Operating Systems Design and Implementation. USENIX Association, 279--292.
107. Mike Ter Louw, Karthik Thotta Ganesh, and V. N. Venkatakrishnan. 2010. AdJail: Practical enforcement of confidentiality and integrity policies on web advertisements. In Proceedings of the USENIX Security Symposium. 371--388.
108. Trusted Computing Group. 2011. TPM Main Specification. Retrieved from http://www.trustedcomputinggroup.org/resources/tpm_main_specification. (2011).
109. Chia-Che Tsai, Kumar Saurabh Arora, Nehal Bandi, Bhushan Jain, William Jannen, Jitin John, Harry A. Kalodner, Vrushali Kulkarni, Daniela Oliveira, and Donald E. Porter. 2014. Cooperation and security isolation of library OSes for multi-process applications. In Proceedings of the 9th European Conference on Computer Systems. ACM, 9.
110. Steve Vandebogart, Petros Efstathopoulos, Eddie Kohler, Maxwell Krohn, Cliff Frey, David Ziegler, Frans Kaashoek, Robert Morris, and David Mazières. 2007. Labels and event processes in the Asbestos operating system. ACM Trans. Comput. Syst. 25, 4 (December 2007).
111. Thorsten Von Eicken, Chi-Chao Chang, Grzegorz Czajkowski, Chris Hawblitzel, Deyu Hu, and Dan Spoonhower. 1999. J-kernel: A capability-based operating system for java. In Secure Internet Programming. Springer, 369--393.
112. David A. Wagner. 1999. Janus: An Approach for Confinement of Untrusted Applications. Ph.D. Dissertation. Department of Electrical Engineering and Computer Sciences, University of California at Berkeley.
113. Robert Wahbe, Steven Lucco, Thomas E. Anderson, and Susan L. Graham. 1994. Efficient software-based fault isolation. In ACM SIGOPS Operating Systems Review, Vol. 27. ACM, 203--216.
114. Helen J. Wang, Chris Grier, Alexander Moshchuk, Samuel T. King, Piali Choudhury, and Herman Venter. 2009. The multi-principal OS construction of the Gazelle web browser. In Proceedings of the USENIX Security Symposium, Vol. 28.
115. Xi Wang, David Lazar, Nickolai Zeldovich, Adam Chlipala, and Zachary Tatlock. 2014. Jitk: A trustworthy in-kernel interpreter infrastructure. In Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI’14). 33--47.
116. Robert N. M. Watson, Jonathan Anderson, Ben Laurie, and Kris Kennaway. 2010. Capsicum: Practical capabilities for UNIX. In Proceedings of the USENIX Security Symposium. 29--46.
117. Andrew Whitaker, Marianne Shaw, and Steven D. Gribble. 2002. Scale and performance in the Denali isolation kernel. ACM SIGOPS Operating Systems Review 36, SI (2002), 195--209.
118. Chiachih Wu, Yajin Zhou, Kunal Patel, Zhenkai Liang, and Xuxian Jiang. 2014. Airbag: Boosting smartphone resistance to malware infection. In Proceedings of the Network and Distributed System Security Symposium.
119. Weiyi Wu and Bryan Ford. 2015. Deterministically deterring timing attacks in Deterland. Conference on Timely Results in Operating Systems (TRIOS).
120. Yongzheng Wu, Sai Sathyanarayan, Roland H. C. Yap, and Zhenkai Liang. 2012. Codejail: Application-transparent isolation of libraries with tight program interactions. In Computer Security--ESORICS 2012. Springer, 859--876.
121. Xi Xiong, Donghai Tian, and Peng Liu. 2011. Practical protection of kernel integrity for commodity OS from untrusted extensions. In NDSS.
122. Rubin Xu, Hassen Saïdi, and Ross Anderson. 2012. Aurasium: Practical policy enforcement for android applications. In USENIX Security Symposium. 539--552.
123. Jisoo Yang and Kang G. Shin. 2008. Using hypervisor to provide data secrecy for user applications on a per-page basis. In Proceedings of the 4th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments. ACM, 71--80.
124. Zhi Yang, Lihua Yin, Miyi Duan, and Shuyuan Jin. 2011. Poster: Towards formal verification of DIFC policies. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS’11). ACM, New York, NY, 873--876. DOI:http://dx.doi.org/10.1145/2046707.2093515
125. Bennet Yee, David Sehr, Gregory Dardyk, J. Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar. 2009. Native client: A sandbox for portable, untrusted x86 native code. In Proceedings of the 2009 30th IEEE Symposium on Security and Privacy. IEEE, 79--93.
126. Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. 2006. Making information flow explicit in HiStar. In Proceedings of the 7th Symposium on Operating Systems Design and Implementation (OSDI). 263--278.
127. Yinqian Zhang, Ari Juels, Alina Oprea, and Michael K. Reiter. 2011. Homealone: Co-residency detection in the cloud via side-channel analysis. In Proceedings of the 2011 IEEE Symposium on Security and Privacy (SP). IEEE, 313--328.
128. Lu Zhao, Guodong Li, Bjorn De Sutter, and John Regehr. 2011. ARMor: Fully verified software fault isolation. In Proceedings of the 2011 International Conference on Embedded Software (EMSOFT). IEEE, 289--298.
129. Xin Zhao, Kevin Borders, and Atul Prakash. 2005. Svgrid: A secure virtual environment for untrusted grid applications. In Proceedings of the 3rd International Workshop on Middleware for Grid Computing. ACM, 1--6.
130. Yajin Zhou, Xiaoguang Wang, Yue Chen, and Zhi Wang. 2014a. ARMlock: Hardware-based fault isolation for ARM. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM, 558--569.
131. Zongwei Zhou, Miao Yu, and Virgil D. Gligor. 2014b. Dancing with giants: Wimpy kernels for on-demand isolated I/O. In Proceedings of the 2014 IEEE Symposium on Security and Privacy (SP). IEEE, 308--323.

Index Terms

• General and reference

  • Document types

    • Surveys and overviews

• Security and privacy

  • Systems security