A classification scheme for sandboxes

In recent time there has been a marked increase in security flaws due to the increase in the use of untrusted applications. In some instances trusted application that have been compromised through common vulnerabilities such as buffer overflow attacks also result in a breach of security. On of the more prominent themes of security software today is the idea of containing applications through building isolated execution environments or sandboxes for them to operate in, thus limiting the damage they can do to the system. Several such independent tools have been developed. We have in this thesis presented a means to classify these tools, based on a basic set of primitives that we have identified to be central to the idea of sandboxing. We also present two broad categories within which implementations of sandboxes could fit. The classification scheme is visually represented assisting future designers of sandboxes in translating security objectives and policies into a sandbox design. The classification can help translate the design into an implementation. In order to demonstrate the effectiveness of the classification scheme we present a comparative analysis of the five prominent sandboxes that have been proposed or implemented.