From dependable multi-user to dependable multi-application operating systems: invited talk

• Authors: Wolfram Schulte
• Venue: Proceedings of the first ACM workshop on Secure execution of untrusted code
• Year: 2009

In this talk I will report on two operating system (OS) efforts at Microsoft Research: Singularity [1, 2] and Service OS [3, 4]. Singularity focuses on the construction of dependable multi-user operating systems through innovation in the areas of systems, languages, and tools. One of Singularity's major innovations is for example that Singularity uses a new type safe language and an abstract instruction set to enable what we call Software Isolated Processes (SIPs). SIPs provide the strong isolation guarantees of OS processes without the overhead of hardware-enforced protection domains. Singularity runs each program, device driver, or system extension in its own SIP. SIPs cannot be extended at runtime and don't share data, but they come with contracts and manifests that are statically enforced at compile- or install time. However designing an OS as a multi-user system might not be the right OS model for the future. Today most personal computers are no longer shared by different users, but shared by mutually distrusting applications. The browser platform is the prime example for this change: a single webpage often combines multiple applications from different service providers, all of which run within the same process without coherent support for resource access, control, and sharing. This makes web browsers a vulnerable platform. In the light of these changes we envision Service OS, a multi-service OS on which web applications and traditional desktop applications converge. A service can be either code or data. Services are hosted in the cloud and cached on the client. The owner of the service is an OS principal; in the context of a browser we use the origin of a website as a principal. Like traditional operating system, only the service OS kernel controls resources and can grant access. But unlike a traditional OS, Service OS needs new resource management policies, to capture the often hierarchical nature of application compositions. We will sketch the design of Service OS, discuss where we intend to leverage Singularity technology, and point out outstanding research challenges.