Mar. 3, 2009 to Mar. 4, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CATCH.2009.45
Many software systems in use today have enormous trusted computing bases (TCBs). We propose an architecture that makes it possible to shrink the TCB of many such systems. Our solution is based on a virtual-machine (VM) with added information-flow capabilities. In our architecture, all application programs run outside of the TCB under the control of the VM and cannot cause information leaks even if they try. We have implemented a prototype of this architecture and found that the resulting run-time overhead is much lower than expected. In many deployment contexts, it will be perfectly reasonable to make such a moderate performance sacrifice for the benefit of security.
system security engineering, vulnerability prevention, virtual machines
Michael Franz, "Information-Flow Aware Virtual Machines: Foundations for Trustworthy Computing", CATCH, 2009, Conference For Homeland Security, Cybersecurity Applications & Technology, Conference For Homeland Security, Cybersecurity Applications & Technology 2009, pp. 91-96, doi:10.1109/CATCH.2009.45