Exploring Compartmentalisation Hypotheses with SOAAP
Khilan Gudka, Robert M Watson, Steven Hand, Ben Laurie, and Anil Madhavapeddy.
Paper in the 2012 IEEE Sixth International Conference on Self-Adaptive and Self-Organizing Systems Workshops.
Application compartmentalisation decomposes software into sandboxed components in order to mitigate security vulnerabilities, and has proven effective in limiting the impact of compromise. However, experience has shown that adapting existing C-language software is difficult, often leading to problems with correctness, performance, complexity, and most critically, security. Security-Oriented Analysis of Application Programs (SOAAP) is an in-progress research project into new semi-automated techniques to support compartmentalisation. SOAAP employs a variety of static and dynamic approaches, driven by source code annotations termed compartmentalisation hypotheses, to help programmers evaluate strategies for compartmentalising existing software.