CT-T: A System Structure for Secretless Security

题目：CT-T：一种用于无秘密安全的系统结构i: John C. knight该项目开发了一种基于定制程序多样性的软件服务保护新方法。使用该方法的系统有两个有价值的属性：(1)可以构造证明，表明系统不会被一类攻击所破坏，无论服务中存在什么漏洞；(2)他们的保护不依赖于保守任何秘密。该方法的基础是观察到，在不影响程序的正常操作的情况下，可以通过施加人为的执行约束来减少程序的可接受状态集。这种约束的例子包括限制程序可以使用的地址或指令。人为约束是由编译器、链接器或服务器上的运行时系统机械地施加的，以产生变体。在一个系统中，两个或多个不同的变量在相同的输入上并行运行，从而产生一个具有总体约束的系统，该约束是变量约束的交集。通过对变量的适当选择约束，可以使总体约束不令人满意。例如，通过在两个变体之间划分地址空间，任何需要引用绝对地址的攻击都必须失败。攻击无法成功，因为这样做需要满足无法满足的约束。

NSF 0524432TITLE: CT-T: A System Structure for Secretless SecurityPI: John C. KnightThis project develops a new approach to software service protection based on tailored program diversity. Systems using the approach have two valuable properties: (1) proofs can be constructed showing that the systems cannot be compromised by a class of attacks, no matter what vulnerabilities exist in the service; and (2) their protection does not depend on keeping any secrets. The basis of the approach is the observation that, without affecting the normal operation of a program, the set of acceptable states for the program can be reduced by imposing artificial execution constraints. Examples of such constraints include limiting the addresses or instructions that the program can use. An artificial constraint is imposed mechanically by a compiler, linker, or run-time system on a server to produce a variant. A system is constructed in which two or more different variants operate in parallel on the same input, thereby producing a system with an overall constraint that is the intersection of the constraints of the variants. With appropriate choices of the constraints for the variants, the overall constraint can be made unsatisfiable. For example, by partitioning the address space between the two variants, any attack that requires referencing an absolute address must fail. Attacks cannot succeed because to do so would require satisfying the unsatisfiable constraint.