"Can We Make Operating Systems Reliable and Secure?

[Tomahawk]

http://rapidshare.de/files/22977232/Can ... e.pdf.html

IEEE Computer Magazine May 2006 Issue


Andrew S. Tanenbaum, Jorrit N. Herder, and Herbert Bos
Vrije Universiteit, Amsterdam

Abstract:
Microkernels—long discarded as unacceptable because of their lower performance
compared with monolithic kernels—might be making a comeback in operating systems
due to their potentially higher reliability,which many researchers now regard as more
important than performance.


Introduction:
When was the last time your TV set crashed
or implored you to download some emergency
software update from the Web? After
all, unless it is an ancient set, it is just a computer
with a CPU, a big monitor, some analog
electronics for decoding radio signals, a couple of
peculiar I/O devices—a remote control, a built-in VCR
or DVD drive—and a boatload of software in ROM.
This rhetorical question points out a nasty little secret
that we in the computer industry do not like to discuss:
Why are TV sets, DVD recorders, MP3 players, cell
phones, and other software-laden electronic devices reliable
and secure but computers are not? Of course there
are many “reasons”—computers are flexible, users can
change the software, the IT industry is immature, and
so on—but as we move to an era in which the vast
majority of computer users are nontechnical people,
increasingly these seem like lame excuses to them.
What consumers expect from a computer is what they
expect from a TV set: You buy it, you plug it in, and it
works perfectly for the next 10 years. As IT professionals,
we need to take up this challenge and make computers
as reliable and secure as TV sets.
The worst offender when it comes to reliability and
security is the operating system. Although application
programs contain many flaws, if the operating system
were bug free, bugs in application programs could do
only limited damage, so we will focus here on operating
systems.
However, before getting into the details, a few words
about the relationship between reliability and security
are in order. Problems with each of these domains often
have the same root cause: bugs in the software. A buffer
overrun error can cause a system crash (reliability problem),
but it can also allow a cleverly written virus or
worm to take over the computer (security problem).
Although we focus primarily on reliability, improving
reliability can also improve security.


......................


Conclusion:
Each of the four different attempts to improve operating
system reliability focuses on preventing buggy
device drivers from crashing the system.
In the Nooks approach, each driver is individually
hand wrapped in a software jacket to carefully control
its interactions with the rest of the operating system, but
it leaves all the drivers in the kernel. The paravirtual
machine approach takes this one step further and moves
the drivers to one or more machines distinct from the
main one, taking away even more power from the drivers.
Both of these approaches are intended to improve
the reliability of existing (legacy) operating systems.
In contrast, two other approaches replace legacy operating
systems with more reliable and secure ones. The
multiserver approach runs each driver and operating system
component in a separate user process and allows
them to communicate using the microkernelΆs IPC mechanism.
Finally, Singularity, the most radical approach,
uses a type-safe language, a single address space, and formal
contracts to carefully limit what each module can do.
Three of the four research projects—L4-based paravirtualization,
Minix 3, and Singularity—use microkernels.
It is not yet known which, if any, of these approaches will
be widely adopted in the long run. Nevertheless, it is interesting
to note that microkernels—long discarded as unacceptable
because of their lower performance compared
with monolithic kernels—might be making a comeback
due to their potentially higher reliability, which many people
now regard as more important than performance. The
wheel of reincarnation has turned.