Practical Language-Based Security, From The Ground Up

实用的基于语言的安全性，从头开始

• 批准号: 0209163
• 负责人: Michael Franz
• 金额: $ 30万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-08-01 至 2005-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0209163&HistoricalAwards=false
• 关键词: Practical; Language; Based; Security; Ground

A comprehensive security architecture is proposed that uses language-based mechanisms to eliminate errors due to circumvention of type safety, be they intentional or erroneous, and that additionally uses security policy mechanisms to contain malicious behavior. This approach extends techniques previously applied to mobile code and is based on a combination of a) mechanically verifying the absence of such errors in any software before it is run, using code representations that can be checked for such errors or that rule out errors in the first place, and b) monitoring executing software for malicious activity.The proposed system consists of multiple layers, each of which is secured by the layer below it, the lowest of which can be provided in tamper-resistant hardware. Key to the solution is to provide a typed hardware abstraction layer (THAL) that enables the construction of a type-safe system "from the ground up", all the way down to the tamper-proof hardware. Hence, the goal is to build a practical system about which we can make security guarantees from the hardware up, and not just "from the operating system up".

一个全面的安全体系结构，提出了使用基于语言的机制，以消除由于规避类型安全的错误，无论是故意的或错误的，并另外使用安全策略机制，以遏制恶意行为。 该方法扩展了先前应用于移动的代码的技术，并且基于以下的组合：a）在任何软件运行之前，使用可以检查此类错误或首先排除错误的代码表示来机械地验证该软件中不存在此类错误，以及B）监视执行软件的恶意活动。每一个都由其下面的层保护，最下面的层可以在防篡改硬件中提供。 解决方案的关键是提供一个类型化的硬件抽象层（塔尔），它支持“从底层到防篡改硬件”的类型安全系统的构建。 因此，我们的目标是建立一个实用的系统，我们可以从硬件上保证安全，而不仅仅是“从操作系统上”。