FlexBox: Sandboxing Internet servers based on layer-7 contexts

Ayumu Tanoue, Makoto Shimamura, Miyuki Hanaoka, Kenji Kono

研究成果: Conference contribution

抄録

Internet servers are constantly exposed to malicious attacks launched remotely. Sandbox is a promising approach to reducing the damage caused by malicious attacks. A sandbox system provides a restricted environment for executing programs/codes from an Internet server, in which the accessible resources are limited to those required for legal execution. However, traditional sandbox systems are not suitable for preventing sensitive files, legally accessed by Internet servers, from being leaked or tampered. A sandbox system must permit access to sensitive files if the sandboxed server requires access to them. This paper presents FlexBox, a novel sandbox system that reduces the possibility of leaking or tampering with sensitive files accessed by Internet servers. The key observation is that Internet servers typically have several execution states, each of which requires different access rights to resources such as files, especially sensitive files that are usually accessed only in a few execution states. Therefore, if FlexBox dynamically changes a set of accessible files according to servers' execution states, it is expected to dramatically reduce the possibility of information leakage/tampering. To obtain the execution states of Internet servers, FlexBox exploits the layer-7 contexts of Internet servers, i.e., it monitors the network messages exchanged between the server and clients. We demonstrate that FlexBox can be applied to several real Internet servers and the overhead from FlexBox is reasonably low.

本文言語English
ホスト出版物のタイトルIEEE Symposium on Computers and Communications 2008, ISCC 2008
ページ386-391
ページ数6
DOI
出版ステータスPublished - 2008
イベント13th IEEE Symposium on Computers and Communications, ISCC 2008 - Marrakech, Morocco
継続期間: 2008 7 62008 7 9

出版物シリーズ

名前Proceedings - IEEE Symposium on Computers and Communications
ISSN(印刷版)1530-1346

Other

Other13th IEEE Symposium on Computers and Communications, ISCC 2008
CountryMorocco
CityMarrakech
Period08/7/608/7/9

ASJC Scopus subject areas

  • Software
  • Signal Processing
  • Mathematics(all)
  • Computer Science Applications
  • Computer Networks and Communications

フィンガープリント 「FlexBox: Sandboxing Internet servers based on layer-7 contexts」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル