Overshadow

摘要: Commodity operating systems entrusted with securing sensitive data are remarkably large and complex, consequently, frequently prone to compromise. To address this limitation, we introduce a virtual-machine-based system called Overshadow that protects the privacy integrity of application data, even in event total OScompromise. presents an normal view its resources, but OS encrypted view. This allows carry out complex task managing application's without allowing it read or modify them. Thus, offers last line defense for data.Overshadow builds on multi-shadowing, novel mechanism different views "physical" memory, depending context performing access. primitive additional dimension protection beyond hierarchical domains implemented by traditional processor architectures.We present design implementation show how new semantics can be integrated existing systems. Our has been fully used protect wide range unmodified legacy applications running Linux system. We evaluate performance our implementation, demonstrating approach is practical.