CT-ISG: Designing Next-Generation, Reliable Internet Servers

点击翻译按钮获取中文摘要

NSF 0523243 CT-ISG: Designing Next-Generation, Reliable Internet Servers Eugene H. SpaffordComputing systems, and especially software on critical servers, are constantly becoming more complex. This addition of features has contributed to greater complexity and to the addition of significant, ongoing vulnerabilities. In part, this may be traced to design decisions that have depended upon adding software for new functions rather than adding additional hardware to support greater separation and enhanced security. The falling cost of IT hardware suggests that this latter approach may be more cost-effective for secure system development. The focus of this research is to investigate the construction of a complex computer server system from simpler, separate computer systems. The effort will explore how to apply well-known (but seldom used) security engineering principles coupled with newer design features to produce highly-secured components. The research will also develop metrics that will allow objective comparison of the vulnerabilities and benefits of the resultant system against more conventional architectures. The expected outcomes of this project will be: 1) validation or disproval of the value of a number of security engineering techniques; 2) a demonstration prototype of a server that should be more secure against attack than are more conventional systems; 3) an approach to designing objective metrics for measuring server vulnerabilities; 4) materials to enable use of the prototype in educational settings.