Splice: Efficiently Removing a User's Data from In-memory Application State
Splice: Efficiently Removing a User's Data from In-memory Application State
复制标题
DOI：
10.1145/3576915.3623070
复制
发表时间：
2023-11
期刊：
影响因子：
--
通讯作者：
Xueyuan Han;James Mickens;Siddhartha Sen
中科院分区：
文献类型：
--
作者：
Xueyuan Han;James Mickens;Siddhartha Sen
Splice是一个新的编程框架，它允许有安全意识的应用程序有效地定位和删除用户的内存状态。核心技术挑战是确定如何删除用户的内存值，而不破坏涉及其余用户的内存状态的特定于应用程序的语义不变量。Splice使用三种技术解决了这个问题：污点跟踪（它跟踪用户的数据如何流经内存），合成删除（它覆盖每个用户拥有的内存值，用一个保留封闭数据结构的符号约束的值替换它），以及一个新颖的类型系统（它迫使应用程序使用防御性编程，以避免以不安全的方式计算合成删除的值）。使用四个现实的应用程序，我们移植到拼接，我们表明，拼接的类型系统和防御编程的要求是不繁重的开发人员。我们还表明，拼接的运行时开销是类似于以前的污点跟踪系统，同时使强大的删除语义。
Splice is a new programming framework that allows security-conscious applications to efficiently locate and delete a user's in-memory state. The core technical challenge is determining how to delete a user's memory values without breaking application-specific semantic invariants involving the memory state of remaining users. Splice solves this problem using three techniques: taint tracking (which traces how a user's data flows through memory), deletion by synthesis (which overwrites each user-owned memory value in place, replacing it with a value that preserves the symbolic constraints of enclosing data structures), and a novel type system (which forces applications to employ defensive programming to avoid computing over synthesize-deleted values in unsafe ways). Using four realistic applications that we ported to Splice, we show that Splice's type system and defensive programming requirements are not onerous for developers. We also demonstrate that Splice's run-time overheads are similar to those of prior taint tracking systems, while enabling strong deletion semantics.