Practical Language-Based Security, From The Ground Up

实用的基于语言的安全性，从头开始

• 批准号: 0209163
• 负责人: Michael Franz
• 金额: $ 30万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-08-01 至 2005-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0209163&HistoricalAwards=false
• 关键词: Practical; Language; Based; Security; Ground

A comprehensive security architecture is proposed that uses language-based mechanisms to eliminate errors due to circumvention of type safety, be they intentional or erroneous, and that additionally uses security policy mechanisms to contain malicious behavior. This approach extends techniques previously applied to mobile code and is based on a combination of a) mechanically verifying the absence of such errors in any software before it is run, using code representations that can be checked for such errors or that rule out errors in the first place, and b) monitoring executing software for malicious activity.The proposed system consists of multiple layers, each of which is secured by the layer below it, the lowest of which can be provided in tamper-resistant hardware. Key to the solution is to provide a typed hardware abstraction layer (THAL) that enables the construction of a type-safe system "from the ground up", all the way down to the tamper-proof hardware. Hence, the goal is to build a practical system about which we can make security guarantees from the hardware up, and not just "from the operating system up".

提出了一个全面的安全体系结构，它使用基于语言的机制来消除由于类型安全的规定而导致的错误，无论是故意的还是错误的，并且还使用安全策略机制来包含恶意行为。 这种方法扩展了先前应用于移动代码的技术，并基于A）使用可以检查此类错误的代码表示在运行之前机械验证任何软件中缺少此类错误的技术，或者首先排除该错误的错误，以及b）监视执行的软件。防篡改的硬件。 解决方案的关键是提供一个打字的硬件抽象层（thal），该层从头到尾都可以“从头开始”构建类型的安全系统。 因此，目的是建立一个实用的系统，我们可以从硬件中获得安全保证，而不仅仅是“操作系统”。