Threadbox: Sandboxing for Modular Security

2025-06-30

AI Summary

Traditional sandboxing mechanisms require application code refactoring, severely hindering deployment in legacy systems. This paper proposes Threadbox, a fine-grained, thread-level sandboxing framework that enables modular isolation and resource control for arbitrary functions without modifying application architecture. Its core innovation lies in lowering the sandbox boundary to the thread level, synergistically integrating runtime scheduling with OS-level resource isolation to deliver a lightweight, dynamic, and embeddable secure execution environment. Evaluation demonstrates that Threadbox effectively isolates sensitive operations with an average performance overhead of less than 8.2%. It significantly enhances sandbox flexibility, integrability, and practical applicability—advancing secure isolation toward modularity and runtime programmability.

Technology Category

• Application Domains: Security
• Multiagent Systems: Mechanism Design
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

There are many sandboxing mechanisms provided by operating systems to limit what resources applications can access, however, sometimes the use of these mechanisms requires developers to refactor their code to fit the sandboxing model. In this work, we investigate what makes existing sandboxing mechanisms challenging to apply to certain types of applications, and propose Threadbox, a sandboxing mechanism that enables having modular and independent sandboxes, and can be applied to threads and sandbox specific functions. We present case studies to illustrate the applicability of the idea and discuss its limitations.

Problem

• Challenges in applying existing sandboxing mechanisms to certain applications
• Proposing Threadbox for modular and independent sandboxing
• Enabling sandboxing for threads and specific functions

Innovation

• Modular sandboxing for independent security
• Threadbox sandboxes specific functions directly
• No code refactoring for sandbox application