Exploiting Segmentation Mechanism for Protecting against Malicious Mobile Code

摘要: This paper describes a mechanism for protecting against malicious mobile code. As code is linked with hosting application and executed in the same process, fine-grained protection domain providing an intra-process required to prevent from unauthorized access. introduces multi-protection page table: of virtual memory that enables domains be supported at kernel level. A (1) confines accesses by authorized areas, (2) restricts system calls issued code, (3) efficient cross-domain among codes application. Efficiency encourages use domains. demonstrates table can implemented efficiently on most widely used architecture; is, Intel x86 family. The presented implementation achieves reasonable performance practical use; one round-trip call requires 226 608 cycles. Experimental results show overhead only 6.1% 15.8% real ANY OTHER IDENTIFYING INFORMATION OF THIS REPORT Submitted publication DISTRIBUTION STATEMENT technical report available ONLY through http://www.is.s.u-tokyo.ac.jp/techreports/FILES.html. SUPPLEMENTARY NOTES DATE May 17, 2000 TOTAL NO. PAGES 16 WRITTEN LANGUAGE English REFERENCES 15 DEPARTMENT SCIENCE Faculty Science, University Tokyo 7-3-1 Hongo, Bunkyo-ku, 113, Japan Exploiting Segmentation Mechanism Protecting Malicious Mobile Code Takahiro Shinagawa† Kenji Kono††,††† Takashi Masuda†† †Department Information Graduate School Hongo 113-0033 Email:shina@is.s.u-tokyo.ac.jp ††Department Computer Electro-Communications 1-5-1 Chofugaoka Chofu-shi, 182-8585 Email:{kono, masuda}@cs.uec.ac.jp †††Japan Science Technology Corporation