软硬件共同保护操作系统安全

The operating system (OS) is the backbone¹ of your computer. If the OS is compromised（妥协，连累） , attackers can take over your computer – or crash it. Now researchers at North Carolina State University have developed an efficient system that utilizes² hardware and software to restore an OS if it is attacked. At issue are security attacks in which an outside party successfully compromises one computer application (such as a Web browser) and then uses that application to gain access to the OS. For example, the compromised application could submit a "system call" to the OS, effectively asking the OS to perform a specific function. However, instead of a routine function, the attacker would use the system call to attempt to gain control of the OS. #

"Our goal is to give the OS the ability to survive such attacks," says Dr. Yan Solihin, an associate professor of electrical and computer engineering at NC State and co-author of a paper describing the new system. "Our approach has three components⁴: attack detection; security fault isolation⁵; and recovery."

The concept is to take a snapshot of the OS at strategic points in time (such as system calls or interrupts), when it is functioning normally and then, if the OS is attacked, to erase⁶ everything that was done since the last "good" snapshot was taken – effectively going back in time to before the OS attack. The mechanism⁷ also allows the OS to identify the source of the attack and isolate⁸ it, so that the OS will no longer be vulnerable to attacks from that application.

The idea of detecting attacks and re-setting a system to a safe state is a well-known technique for restoring a system's normal functions after a failure, but this is the first time researchers have developed a system that also incorporates（包含，吸收） the security fault isolation component³. This critical component prevents the OS from succumbing⁹ to（屈服于） the same attack repeatedly. #

The concept of taking snapshots of the OS and using it to replace the OS if it is compromised was previously¹⁰ viewed as impractical¹¹, since taking these snapshots and running such a system significantly slowed computer operating speeds. "But we've developed hardware support that allows the OS to incorporate these survivability（生命力） components more efficiently¹², so that they take up less time and energy," Solihin says. The researchers say the survival system takes up less than 5 percent of the OS's operating overhead.#p#分页标题#e#