Paper Info
Title
Reducing TCB of Linux Kernel Using User-Space Device Driver.
Abstract
The Linux kernel has enormous code size, which makes it a prime target exploited by attackers to steal the privacy of the system, or even to crash the system. Especially, the untrusted Linux device drivers, which take the largest code size of kernel, bring great threats to the kernel. However, current research that tries to isolate the Linux device drivers, either has a large attack surface due to the complex features exposed to applications, or leaves the device drivers in the TCB (Trusted Computing Base). We move the device drivers into user-space to reduce the TCB of kernel, and alter the OS features as libraries to decrease kernel's attack surface. This paper presents an architecture based on proxy driver and library OSes to separate untrusted and unmodified device drivers from kernels enhanced with a narrower system call interface. We discuss the implementation of a prototype, and also the case study about an unmodified Ethernet card driver supported by the prototype. The evaluation of the case study shows an acceptable performance overhead. We manage to narrow the attack surface by reducing 81.6% of the system calls, and reduce the TCB by decreasing the code base (inside TCB) of the Ethernet card driver into 900 LoC.
Year
DOI
Venue
2016
10.1007/978-3-319-49583-5_45
ALGORITHMS AND ARCHITECTURES FOR PARALLEL PROCESSING, ICA3PP 2016
Keywords
Field
DocType
Secure kernel,Trusted computing base,Library operating system,User-space device driver
Kernel (linear algebra),Crash,Attack surface,Computer science,System call,Ethernet,User space,Trusted computing base,Operating system,Linux kernel,Embedded system
Conference
Volume
ISSN
Citations 
10048
0302-9743
0
PageRank 
References 
Authors
0.34
12
3
Name
Order
Citations
PageRank
Weizhong Qiang113727.22
Kang Zhang200.34
Hai Jin36544644.63