Download N-variant framework

From Dependability

Contents

Using the N-Variant System Framework

Introduction

The N-Variant System framework builds upon artificial diversity to provide provable security properties. It works by running multiple artificially diversified variants in parallel giving the variants identical inputs and ensuring that all the variants behave identically. We can construct variants that have disjoint attack precondition, for certain classes of attacks. As a result, any attack (of the protected attack classes), that can successfully compromise one variant in the system, will necessarily cause another variant to raise an alarm such as a segmentation fault. For more details on the framework itself please read our paper. Our kernel implementation of this framework monitors the variants by ensuring that all the variants make identical system calls, and replicates the input by performing the system call and giving all the variants the same result. More details about the implementation can also be found in our paper.

To use our implementation you will first need to install our modified Linux kernel. Please be sure you meet the system requirements. Second you will need to install NV Exec. This program is needed bring a N-Variant System into execution, giving each variant the environment variables and parameters you specify. Details on how to use this program can be found below.

System Requirements

  • x86 Computer
  • Fedora Core 5
  • Basic Development Tools (e.g. gcc, make, ...)
  • Root Access
  • qt-devel Package

Installing the N-Variant Kernel

  1. Download http://dependability.cs.virginia.edu/software/nvariant/linux-2.6.16.i686-nvariant.tar.bz
  2. Unpack the archive (tar -xjvf linux-2.6.16.i686-nvariant.tar.bz)
  3. Become root
  4. If you do not have the qt-devel package installed get it (yum -y install qt-devel)
  5. You may need to install the g++ compiler (yum -y install gcc-c++)
  6. Enter linux-2.6.16.i686 directory (cd linux-2.6.16.i686)
  7. Copy the kernel-2.6.16-i686.config to the current directory (cp configs/kernel-2.6.16-i686.config .config)
  8. Type make xconfig and check that the configuration matches your machine
  9. Type make bzImage (Takes 10-15 minutes)
 10. Type make modules (Takes about 1 hour)
 11. Type make modules_install
 12. Type make install

Installing over VMWare

  1. Install VMWare player (www.vmware.com)
  2. Install Fedora Core 5 from the Virtual Appliance Marketplace
  3. Configure Fedora Core 5
  4. Follow directions above

Installing NV Exec

  1. Download http://dependability.cs.virginia.edu/software/nvariant/nvexec.tar.gz
  2. Unpack the archive (tar -xzvf nvexec.tar.gz)
  3. Build the archive. (make)
  4. Copy the nvexec executable to a directory in your PATH

Executing a N-Variant System

Before bringing an N-Variant system into execution, be sure that you are running our modified kernel. You can verify this by typing "uname -r" into the shell. It should say "2.6.16-nvariant". If not reboot the machine and select "Fedora Core(2.6.16-nvariant)" from the boot menu. To invoke a N-Variant System using NV Exec, you need to call NV Exec with the command lines of the different variants separated by "---". For example:

nvexec ENV=V1 ./v1_prog v1_arg --- ENV=V2 ./v2_prog v2_arg

This command will invoke an N-Variant system with the first variant executing v1_prog with the environment variable ENV=V1 and v1_arg as its only argument. The second variant will execute v2_prog with the environment variable ENV=V2 and v2_arg as its only argument. The current implementation does not support all system calls and some of them are currently disabled in N-Variant System processes (they still work for regular processes). Some of the disabled system calls include those required for loading dynamic libraries. As a result your variants will need to be statically linked. For more information please see the README, included in the nvexec.tar.gz archive.

Current Restrictions and Disclaimer

Keep in mind that this software is for experimental research purposes. As such, there are several limitations and caveats

  • Use at your own risk. No guarantee for any purpose
  • Static binaries only. We do not yet support dynamic linking.

Having said all that, we have successfully ran the Apache web server under the N-Variant framework.

Notes

  • To select the NVariant version of the kernel, you typically need to press a key at boot time. Grub will start up and give you the option of starting NVariant.
  • To make sure you're running NVariant, use the command uname -r
Retrieved from "http://dependability.cs.virginia.edu/info/Download_N-variant_framework"