Security through Component-based Isolation Framework (SCIF)

ABSTRACT: Networked PCs are critical to the success of data-based missions, and the complex software they execute is both the source of their power and their prime area of vulnerability. Applications and services are often composed of multiple software components developed by different vendors or open source communities, who may in turn incorporate components developed by another tier of vendors. To help minimize the damage of an exploit, data must not be allowed to flow freely between all components running on a system. To improve application security and minimize the damage done by malicious or faulty code, we propose a component-based isolation framework. Mutable protection domains will provide the basis for a lightweight component-based isolation framework. We will apply a user-level sandboxing scheme to separate application-specific services and components from those of the underlying kernel. To optimize performance, we will also investigate approaches to isolate components accessing shared hardware to provide CPU and IO protection. Finally, we will design techniques to proactively detect components at risk of fault, so they can be highlighted for extra attention. BENEFIT: We expect the full-scope framework to have immediate and tangible benefit for a number of military computing systems. In particular, the framework will help networked systems fight through cyber attacks. The technologies developed under this effort will enhance the effectiveness of existing secure OS tools by incorporating the component-based isolation techniques.