Software Fault Isolation (SFI) is a form of software sandboxing that refers to the technique of isolating faults such as failures and vulnerabilities to a specific area in a software system. Together with other software sandboxing techniques, SFI remains a widely used practice in many types of software, ranging from web browsers to cloud infrastructure. Therefore, there are often different requirements on throughput, latency, and resource usage that have to be met. To this end, we have evaluated the usage of WebAssembly, a virtual instruction set architecture which has a design that makes it a suitable compilation target for enforcing SFI. Our findings show that WebAssembly compared to native x86-64 code performs favorably on memory-intensive workloads, but poorly on numerically intensive workloads. However, its main strength was found to be in communication between the host environment and the sandboxed environment. We found that communication across the sandbox boundary using WebAssembly-based sandboxing was up to several orders of magnitude faster than inter-process communication methods commonly used in process-based sandboxing. Additionally, we discuss the security model of WebAssembly and how it compares to other sandboxing methods.
| Identifer | oai:union.ndltd.org:UPSALLA1/oai:DiVA.org:liu-205456 |
| Date | January 2024 |
| Creators | Mårtensson Tolentino, Kevin |
| Publisher | Linköpings universitet, Programvara och system |
| Source Sets | DiVA Archive at Upsalla University |
| Language | English |
| Detected Language | English |
| Type | Student thesis, info:eu-repo/semantics/bachelorThesis, text |
| Format | application/pdf |
| Rights | info:eu-repo/semantics/openAccess |
Page generated in 0.0022 seconds