Privtrans : automatically partitioning programs for privilege separation

This work designs techniques and develops a tool called Privtrans that allows for automatically integrate privilege separation into source code, provided a few programmer annotations, and proposes optimization techniques that augment static analysis with dynamic information.

Abstract

Abstract: "Privilege separation partitions a single program into two parts: a privileged program called the monitor and an unprivileged program called the slave. All trust and privileges are relegated to the monitor, which results in a smaller and more secure trust base. Previously the privilege separation procedure, i.e., partitioning one program into the monitor and slave, was done by hand [17,26]. We design techniques and develop a tool called Privtrans that allows us to automatically add privilege separation to source code, provided a few programmer annotations. Additionally, we propose optimization techniques that augment static analysis with dynamic information. Our optimization techniques reduce the number of expensive calls made by the slave to the monitor. We show Privtrans is effective by integrating privilege separation into several open-source applications."