Program-mandering: Quantitative Privilege Separation
Program-mandering: Quantitative Privilege Separation
复制标题
DOI：
10.1145/3319535.3354218
复制
发表时间：
2019-11
期刊：
影响因子：
--
通讯作者：
Shen Liu;Dongrui Zeng;Yongzhe Huang;Frank Capobianco;Stephen McCamant;T. Jaeger;Gang Tan
中科院分区：
文献类型：
--
作者：
Shen Liu;Dongrui Zeng;Yongzhe Huang;Frank Capobianco;Stephen McCamant;T. Jaeger;Gang Tan
权限分离是一种提高软件安全性的有效技术。然而，过去的分区系统不允许程序员在安全性和性能之间进行定量权衡。在本文中，我们描述了我们称为PM的工具链。它能够自动找到程序分区中的最优边界。这是通过求解一个整数规划模型来实现的，该模型针对用户选择的度量进行优化，同时满足其他度量上剩余的安全性和性能约束。我们选择安全度量来推断计算出的分区对信息流控制的执行效果，以便：（1）保护程序免受低完整性输入的影响，或者（2）防止程序机密信息泄露。结果，位于最优分区边界上的敏感模块中的函数会自动识别出在何处需要解密。我们使用PM对一组实际程序进行实验以保护机密性和完整性；结果表明，在适度的用户指导下，PM能够找到在安全性和性能之间比之前需要手动解密的工具所找到的分区具有更好平衡的分区。
Privilege separation is an effective technique to improve software security. However, past partitioning systems do not allow programmers to make quantitative tradeoffs between security and performance. In this paper, we describe our toolchain called PM. It can automatically find the optimal boundary in program partitioning. This is achieved by solving an integer-programming model that optimizes for a user-chosen metric while satisfying the remaining security and performance constraints on other metrics. We choose security metrics to reason about how well computed partitions enforce information flow control to: (1) protect the program from low-integrity inputs or (2) prevent leakage of program secrets. As a result, functions in the sensitive module that fall on the optimal partition boundaries automatically identify where declassification is necessary. We used PM to experiment on a set of real-world programs to protect confidentiality and integrity; results show that, with moderate user guidance, PM can find partitions that have better balance between security and performance than partitions found by a previous tool that requires manual declassification.