一句话:提出 Guardian Council 系统安全防护方案,以应对不可信程序与用户带来的攻击。
系统安全正面临不可信程序与系统用户的严峻挑战。当前使用的防护措施,如缓冲区溢出防护、控制流完整性、侧信道防御和恶意软件检测,均存在局限。软件保护方案虽然灵活,但开销往往过高;硬件保护方案虽然快速,但约束过多或过于陈旧,难以实用。针对这一问题,论文提出名为 Guardian Council 的防护机制,试图在灵活性与性能之间取得平衡,以更有效地抵御各类系统攻击。摘要仅阐述了现有方案的不足与设计动机,未给出具体技术细节与评估结果。
Systems security is becoming more challenging in the face of untrusted programs and system users. Safeguards against attacks currently in use, such as buffer overflows, control-flow integrity, side channels and malware, are limited. Software protection schemes, while flexible, are often too expensive, and hardware schemes, while fast, are too constrained or out-of-date to be practical.