CT-T: A System Structure for Secretless Security

CT-T：无秘密安全的系统结构

• 批准号: 0524432
• 负责人: John Knight
• 金额: $ 165万
• 依托单位: University of Virginia Main Campus
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2005
• 资助国家: 美国
• 起止时间: 2005-10-01 至 2009-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0524432&HistoricalAwards=false
• 关键词: CT; System; Structure; Secretless; Security

NSF 0524432TITLE: CT-T: A System Structure for Secretless SecurityPI: John C. KnightThis project develops a new approach to software service protection based on tailored program diversity. Systems using the approach have two valuable properties: (1) proofs can be constructed showing that the systems cannot be compromised by a class of attacks, no matter what vulnerabilities exist in the service; and (2) their protection does not depend on keeping any secrets. The basis of the approach is the observation that, without affecting the normal operation of a program, the set of acceptable states for the program can be reduced by imposing artificial execution constraints. Examples of such constraints include limiting the addresses or instructions that the program can use. An artificial constraint is imposed mechanically by a compiler, linker, or run-time system on a server to produce a variant. A system is constructed in which two or more different variants operate in parallel on the same input, thereby producing a system with an overall constraint that is the intersection of the constraints of the variants. With appropriate choices of the constraints for the variants, the overall constraint can be made unsatisfiable. For example, by partitioning the address space between the two variants, any attack that requires referencing an absolute address must fail. Attacks cannot succeed because to do so would require satisfying the unsatisfiable constraint.

NSF 0524432标题：CT-T：一种无秘密安全的系统结构PI：John C. KnightThis项目开发了一种基于定制程序多样性的软件服务保护新方法。 使用该方法的系统具有两个有价值的特性：（1）可以构造证明，表明系统不会受到一类攻击的危害，无论服务中存在什么漏洞;（2）它们的保护不依赖于保守任何秘密。 该方法的基础是观察到，在不影响程序的正常运行的情况下，可以通过施加人工执行约束来减少程序的可接受状态集。 这种约束的例子包括限制程序可以使用的地址或指令。 人工约束是由编译器、链接器或服务器上的运行时系统机械地施加的，以产生变体。 构造一个系统，其中两个或更多个不同的变量在同一输入上并行操作，从而产生具有作为变量的约束的交集的总体约束的系统。 通过对变体的约束进行适当的选择，可以使总体约束变得不可满足。 例如，通过在两个变体之间划分地址空间，任何需要引用绝对地址的攻击都必须失败。 攻击不能成功，因为这样做需要满足不可满足的约束。