CT-ISG: Nexus: A New Operating System for Trusted Computing

CT-ISG：Nexus：用于可信计算的新操作系统

• 批准号: 0627699
• 负责人: Emin Sirer
• 金额: --
• 依托单位: Cornell University
• 依托单位国家: 美国
• 项目类别: Continuing grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-09-15 至 2010-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627699&HistoricalAwards=false
• 关键词: CT; ISG; Nexus; New; Operating

Tamper-proof coprocessors for secure computing are poised to become astandard hardware feature on future computers. Current operatingsystems, however, lack the architecture and abstractions required tosupport trustworthy computing. A new OS abstraction, called activeattestation, was developed that enables unforgeable, descriptive,parsimonious certificates about application properties to beconstructed at any time. A new OS mechanism, called secure memoryregions, was implemented that enables applications to protect theintegrity and confidentiality of data on untrusted secondarystorage. Finally, a new OS architecture was implemented that supportsstrong isolation without the use of heavyweight virtual machinetechnology. Combined, these three features enable a new operatingsystem that permits a new class of applications that can providestrong guarantees about their runtime behavior. Such guarantees helpsecure systems against malware and viruses, authenticate users onremote computers, and rule out protocol attacks against distributedsystems.

用于安全计算的防篡改协处理器有望成为未来计算机的标准硬件功能。然而，当前的操作系统缺乏支持可信计算所需的架构和抽象。开发了一种称为主动证明的新操作系统抽象，可以随时构建有关应用程序属性的不可伪造的、描述性的、简约的证书。实施了一种称为安全内存区域的新操作系统机制，使应用程序能够保护不可信辅助存储上数据的完整性和机密性。最后，实现了新的操作系统架构，无需使用重量级虚拟机技术即可支持强隔离。这三个功能相结合，形成了一个新的操作系统，允许新一类应用程序为其运行时行为提供强有力的保证。此类保证有助于保护系统免受恶意软件和病毒的侵害，对远程计算机上的用户进行身份验证，并排除针对分布式系统的协议攻击。