IBM researchers take AXE to computer security

IBM researchers have developed new security technology that will only allow approved applications to run on PCs.

Researchers at IBM's Almaden Labs have developed a way to keep those nasty worms and viruses from running on computers, without the use of antivirus software.

The project is the brainchild of researcher Amit Singh, who has been working for several years on techniques to simplify PCs. Two years ago, Singh could see that computers were being choked by the growing amount of security and management software they were using, and he and fellow researchers Anurag Sharma and Steve Welch set about developing software that would make PCs more easy to use.

The solution? A research project called the Assured Execution Environment, (AXE) which takes a very strict approach to controlling what is run on the computer.

Thanks to a patented IBM technique, AXE loads special "AXE runtime," software into the central part of the operating system, called the kernel, every time the PC is booted up. It then polices every piece of software that is run on the machine, making sure that only authorized code gets used.

Unlike antivirus software, AXE doesn't do this by policing for dangerous software. It simply prohibits any code from running unless it has been pre-configured into a special AXE-friendly format, something the IBM researchers say they can make it virtually impossible for spyware and virus writers to do.

"We are making every machine a unique OS," said Singh, who added that, at present, AXE works with both the Windows and Mac OS operating system kernels.

Users or administrators could use a variety of techniques, including encryption, to ensure that unauthorized software could not be run without their permission. They could also use AXE to make sure that certain programs were only run on specific machines, or even use AXE techniques to make data unreadable, to keep Word or PowerPoint documents away from prying eyes.

The AXE developers say that because some users may not want to have every piece of software they run on their machine "blessed" by a central IT administrator, they've built some flexibility into the software's design. PCs can be configured to allow unknown software to run, but only when approved by the user, or they can set unknown software to run only in a virtual machine environment, where it can't do as much damage to the base operating system.

This idea of creating a "whitelist" of authorized applications is going to be more widely adopted by security vendors, because the traditional antivirus technique of blocking known malware is simply becoming too unwieldy, said Yankee Group Inc. Senior Analyst Andrew Jaquith. "Whitelists are probably the way to go in the future," he said.

Other companies, such as SecureWave and Bit9, have taken a similar approach to security, he said.

The downside of whitelists, however, is that they can create a management headache because administrators have to get involved every time any software is updated. "If Microsoft sends out a hotfix, you're probably going to have to re-register those applications," he said. "The real question is not whether the technology works, but whether it's manageable."

IBM should have a better understanding of how manageable AXE really is by next year. That's when Welch, the project's manager, hopes to have the software in the hands of an early pilot customer.

Users who "really never wanted the openness and complexity of the operating environment that they're running," would benefit most from the AXE security model, he said. Point-of-sale computers or stock-trading machines would be ideal pilot projects, according to Welch.

Whether AXE will ever become part of a shipping product is unknown, but Welch has some experience turning R&D technologies into IBM brands. He was on the team that developed a lot of the ThinkVantage system management technologies that IBM eventually brought to market.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?