Gang Tan, Department of Computer Science and Engineering- Penn State University

Survey on Software-Based Fault Isolation (SFI)

Abstract

When protecting a computer system, it is often necessary to isolate an untrusted component into a separate protection domain and provide only controlled interaction between the domain and the rest of the system. Software-based Fault Isolation (SFI) establishes a logical protection domain by inserting dynamic checks before memory and control-transfer instructions. Compared to other isolation mechanisms, it enjoys the benefits of high efficiency (with less than 5% performance overhead), being readily applicable to legacy native code, and not relying on special hardware or OS support. SFI has been successfully applied in many applications, including isolating OS kernel extensions, isolating plug-ins in browsers, and isolating native libraries in the Java Virtual Machine. In this survey article, we will discuss the SFI policy, its main implementation and optimization techniques, as well as an SFI formalization on an idealized assembly language.

Paper and slides

Download the survey paper Principles and Implementation Techniques of Software-Based Fault Isolation
Powerpoint slides used in teaching Penn State CS 447 (Software Security)

Last updated: May 2019