Process isolation

Process isolation is a set of different hardware and software technologies[1] designed to protect each process from other processes on the operating system. It does so by preventing process A from writing to process B.

Process isolation can be implemented with virtual address space, where process A's address space is different from process B's address space – preventing A from writing onto B.

Security is easier to enforce by disallowing inter-process memory access, in contrast with less secure architectures such as DOS in which any process can write to any memory in any other process.[2]

Limited inter-process communication

In a system with process isolation, limited (controlled) interaction between processes may still be allowed over inter-process communication (IPC) channels such as shared memory, local sockets or Internet sockets. In this scheme, all of the process' memory is isolated from other processes except where the process is allowing input from collaborating processes.

System policies may disallow IPC in some circumstances. For example, in mandatory access control systems, subjects with different sensitivity levels may not be allowed to communicate with each other. The security implications in these circumstances are broad and span applications in network key encryption systematics as well as distributed caching algorithms. Interface-defined protocols such as basic cloud access architecture and network sharing are similarly affected.[3]

Operating systems

Notable operating systems that support process isolation:

Web browsers
See also: List of web browsers

Internet Explorer 4 used process isolation in order to allow separate windowed instances of the browser their own processes; however, at the height of the browser wars, this was dropped in subsequent versions to compete with Netscape Navigator (which sought to concentrate upon one process for the entire Internet suite). This idea of process-per-instance would not be revisited until a decade afterwards, when tabbed browsing became more commonplace.

In Google Chrome's "Multi-Process Architecture"[4] and Internet Explorer 8's "Loosely Coupled IE (LCIE)",[5] tabs containing webpages are contained within their own semi-separate OS-level processes which are isolated from the core process of the browser so as to prevent the crash of one tab/page from crashing the entire browser. This method (known popularly as multiprocess or process-per-tab) is meant to both manage memory and processing by allowing offending tabs to crash separately from the browser and other tabs and manage security.

Browsers with process isolation

Programming languages

Erlang (programming language) is providing a similar concept in user space, by realizing strictly separated lightweight processes.

See also

References
  1. Deconstructing Process Isolation. Aiken, Mark, Fähndrich, Manuel, Hawblitzel, Chris, Hunt, Galen, Larus, James R. Microsoft Research. Oct. 2006
  2. All in one CISSP Exam Guide, 3rd Edition, Shon Harris
  3. Pahl, C (2015). "Containers and clusters for edge cloud architectures--a technology review". 3rd International Conference on Future Internet of Things and Cloud.
  4. Multi-process Architecture, Chromium Blog, Thursday, September 11, 2008
  5. IE8 and Loosely-Coupled IE (LCIE), by Andy Zeigler, Tuesday, March 11, 2008
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.