Isolated Program Execution: An Application Transparent Approach for Executing Untrusted Programs

In this paper, we present a new approach for safe execution of untrusted programs by isolating their effects from the rest of the system. Isolation is achieved by intercepting file operations made by untrusted processes, and redirecting any change operations to a “modification cache” that is invisible to other processes in the system. File read operations performed by the untrusted process are also correspondingly modified, so that the process has a consistent view of system state that incorporates the contents of the file system as well as the modification cache. On termination of the untrusted process, its user is presented with a concise summary of the files modified by the process. Additionally, the user can inspect these files using various software utilities (e.g., helper applications to view multimedia files) to determine if the modifications are acceptable. The user then has the option to commit these modifications, or simply discard them. Essentially, our appro...

• Type: Conference
• Year: 2003
• Where: ACSAC
• Authors: Zhenkai Liang, V. N. Venkatakrishnan, R. Sekar
• Keywords: ACSAC 2003, Modification Cache, Security Privacy, Untrusted, Untrusted Process