Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. Enforcing least privilege memory views for multithreaded applications
 
conference paper

Enforcing least privilege memory views for multithreaded applications

Hsu, Terry Ching Hsiang
•
Hoffman, Kevin
•
Eugster, Patrick
Show more
October 24, 2016
Proceedings of the ACM Conference on Computer and Communications Security
23 ACM Conference on Computer and Communications Security

Failing to properly isolate components in the same address space has resulted in a substantial amount of vulnerabilities. Enforcing the least privilege principle for memory accesses can selectively isolate software components to restrict attack surface and prevent unintended cross-component memory corruption. However, the boundaries and interactions between software components are hard to reason about and existing approaches have failed to stop attackers from exploiting vulnerabilities caused by poor isolation. We present the secure memory views (SMV) model: a practical and efficient model for secure and selective memory isolation in monolithic multithreaded applications. SMV is a third generation privilege separation technique that offers explicit access control of memory and allows concurrent threads within the same process to partially share or fully isolate their memory space in a controlled and parallel manner following application requirements. An evaluation of our prototype in the Linux kernel (TCB < 1,800 LOC) shows negligible runtime performance overhead in real-world applications including Cherokee web server (< 0.69%), Apache httpd web server (< 0.93%), and Mozilla Firefox web browser (< 1.89%) with at most 12 LOC changes.

  • Details
  • Metrics
Type
conference paper
DOI
10.1145/2976749.2978327
Scopus ID

2-s2.0-84995505153

Author(s)
Hsu, Terry Ching Hsiang

Purdue University

Hoffman, Kevin

EFolder Inc.

Eugster, Patrick

Purdue University

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Date Issued

2016-10-24

Publisher

Association for Computing Machineryacmhelp@acm.org

Published in
Proceedings of the ACM Conference on Computer and Communications Security
ISBN of the book

9781450341394

Book part number

24-28-October-2016

Start page

393

End page

405

Editorial or Peer reviewed

REVIEWED

Written at

OTHER

EPFL units
HEXHIVE  
Event nameEvent acronymEvent placeEvent date
23 ACM Conference on Computer and Communications Security

Vienna, Austria

2016-10-24 - 2016-10-28

FunderFunding(s)Grant NumberGrant URL

NSF

CNS-1464155,TC-1117065,TWC-1421910

European Research Council

FP7-617805

Available on Infoscience
April 4, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/248608
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés