CT-ISG: Collaborative Research: Access Control and Downgrading in Information Flow Assurance

这个NSF网络信任项目研究了实现系统满足信息流策略（如机密性和完整性）的高保证的技术。 基线策略表示的组件接口的安全类型的标签，在雅阁与标准的理论，但扩展到包括基于角色的信任管理系统，以处理在分布式系统中的相互不信任。 基线策略被增强为更强大的方法。 这是通过指定某些程序或子程序不受基线政策的约束，而是服从表示信息降级的程序逻辑规范（称为"流程规范“）来实现的。为了检查与基线策略的一致性，使用了类型检查。 为了检查与流程规范的一致性，使用了形式验证工具。 流程规范被编码在标准逻辑中，以便可以使用现成的工具。更广泛的影响是，机密性和完整性需求必须被表达出来，对需求分析师和实现者有明确的意义。 设计必须明确考虑使用访问控制和其他方法来满足信息流要求。 必须检查设计和实现是否符合信息流策略，考虑与不太值得信任的组件的交互。 严格的验证工具必须既能确保遵从性，又能帮助避免在不必要的运行时检查、监视或其他安全措施中浪费资源。 最终，这些工具必须指导开发人员并促进系统管理，以便随着环境的变化和系统的发展而保持可信度。 该项目的直接影响是通过研究，课程和行业合作培训本科生和研究生。

This NSF Cyber Trust project investigates techniques to achieve high assurance that systems satisfy information flow policies like confidentiality and integrity. Baseline policies are expressed by labeling component interfaces with security types, in accord with standard theory but extended to encompass role based trust management systems to deal with mutual distrust in distributed systems. The baseline policy is augmented more powerful methods. This is accomplished by designating certain procedures or subprograms as exempt from the baseline policy and instead subject to a specification in program logic (called ``flowspecs'') that expresses information downgrading. To check conformance with baseline policy, type checking is used. To check conformance with flowspecs, formal verification tools are used. Flowspecs are encoded in standard logic so that off the shelf tools can be used.The broader impact is that confidentiality and integrity requirements must be expressed as such, with clear meaning for requirements analysts and implementers. Designs must explicitly account for the use of access controls and other means to satisfy information flow requirements. Designs and implementations must be checked for conformance with information flow policies, accounting for interaction with less trustworthy components. Rigorous validation tools must serve both to ensure compliance and also to help avoid waste of resources in unnecessary runtime checks, monitoring, or other security measures. Eventually, the tools must guide developers and facilitate system administration, so that trustworthiness is maintained as circumstances change and systems evolve. An immediate impact of the project is in training undergraduate and graduate students through research, coursework, and industry collaborations.