CT-T: A System Structure for Secretless Security

NSF 0524432标题：CT-T：一种无秘密安全的系统结构PI：John C. KnightThis项目开发了一种基于定制程序多样性的软件服务保护新方法。 使用该方法的系统具有两个有价值的特性：（1）可以构造证明，表明系统不会受到一类攻击的危害，无论服务中存在什么漏洞;（2）它们的保护不依赖于保守任何秘密。 该方法的基础是观察到，在不影响程序的正常操作的情况下，可以通过施加人工执行约束来减少程序的可接受状态的集合。 这种约束的例子包括限制程序可以使用的地址或指令。 人工约束是由编译器、链接器或服务器上的运行时系统机械地施加的，以产生变体。 构造一个系统，其中两个或更多个不同的变量在同一输入上并行操作，从而产生具有作为变量的约束的交集的总体约束的系统。 通过对变量的约束的适当选择，可以使总体约束不可满足。 例如，通过在两个变体之间划分地址空间，任何需要引用绝对地址的攻击都必须失败。 攻击不能成功，因为这样做需要满足不可满足的约束。

NSF 0524432TITLE: CT-T: A System Structure for Secretless SecurityPI: John C. KnightThis project develops a new approach to software service protection based on tailored program diversity. Systems using the approach have two valuable properties: (1) proofs can be constructed showing that the systems cannot be compromised by a class of attacks, no matter what vulnerabilities exist in the service; and (2) their protection does not depend on keeping any secrets. The basis of the approach is the observation that, without affecting the normal operation of a program, the set of acceptable states for the program can be reduced by imposing artificial execution constraints. Examples of such constraints include limiting the addresses or instructions that the program can use. An artificial constraint is imposed mechanically by a compiler, linker, or run-time system on a server to produce a variant. A system is constructed in which two or more different variants operate in parallel on the same input, thereby producing a system with an overall constraint that is the intersection of the constraints of the variants. With appropriate choices of the constraints for the variants, the overall constraint can be made unsatisfiable. For example, by partitioning the address space between the two variants, any attack that requires referencing an absolute address must fail. Attacks cannot succeed because to do so would require satisfying the unsatisfiable constraint.