Concept enables PC operating systems to survive attacks

In certain computer security attacks, an outside party compromises one computer application (such as a web browser) and then uses that application to submit a ’system call’ to the operating system, effectively asking the operating system to perform a specific function. However, instead of a routine function, the attacker uses the system call to attempt to gain control of the operating system.

’Our goal is to give the operating system the ability to survive such attacks,’ said Dr Yan Solihin, an associate professor of electrical and computer engineering at North Carolina State. ’Our approach has three components: attack detection, security fault isolation and recovery.’

The concept involves taking a snapshot of the operating system at strategic points in time (such as system calls or interrupts), when it is functioning normally and, then, if the operating system is attacked, to erase everything that was done since the last ’good’ snapshot was taken — effectively going back in time to before the operating system attack. The mechanism also allows the operating system to identify the source of the attack and isolate it, so that the operating system will no longer be vulnerable to attacks from that application.