Collaborative Research NeTS-FIND: Privacy Preserving Attribution and Provenance

现实世界的安全政策总是涉及“谁”和“什么”的问题--谁是主体，他们试图访问哪些数据，等等。相比之下，当今的因特网体系结构主要涉及“如何”和“在哪里”的问题--通过什么协议来交付数据项以及向哪些拓扑端点提供数据。这种与生俱来的目的不协调使得互联网安全成为一个补充性事件-抽象访问控制策略被推到由特定应用程序实施或映射到网络级抽象(例如网络防火墙)提供的较差近似上。此外，这些不完善的机制本身受到攻击而不受惩罚，因为今天的互联网架构提供了功能匿名，将攻击者与任何有意义的责任隔离开来。该项目正在开发两个关键架构功能--主机属性(哪个物理机发送了一个数据包)和数据来源(一个数据包中包含的数据的“来源”是什么)--以实现广泛的安全策略的直接表达。此外，这些属性的实施方式要求网络(在很大程度上)使用它们，但设法保护最终用户的隐私。PI集中在这项工作中的两个关键应用：出于攻击威慑目的的取证追溯和归属，以及防御性数据外泄，以精确控制哪些类型的数据可以通过网络传输。广泛影响：此研究正在开发关键的体系结构组件，以提高网络服务的安全和保证级别。此外，私人投资机构正在研究人员和网络运营商之间就网络安全的关键政策方面展开对话。特别是有关正常流量和攻击流量来源的信息，这些流量必须根据某些策略进行保护。

Real-world security policies invariably involve questions of ``who'' and ``what''--who are the principals, what data are they seeking to access, and so forth. By contrast, the present-day Internet architecture concerns itself primarily with issues of ``how'' and ``where''-- what are the protocols by which a data item is delivered and to which topological endpoints. This inherent dissonance of purpose makes Internet security a bolt-on affair---with abstract access control policies pushed off to be implemented by particular applications or mapped onto the poor approximations provided by network-level abstractions (e.g., network firewalls). Moreover, these imperfect mechanisms are themselves attacked with impunity since today's Internet architecture provides a functional anonymity that insulates attackers from any meaningful liability.This project is developing two key architectural capabilities--host attribution (which physical machine sent a packet) and data provenance (what is the ``origin'' of the data contained within a packet)--to enable the direct expression of a wide-range of security policies. Moreover, these properties are being implemented in a fashion that mandates their use (in a strong sense) by the network, but manages to preserve end-user privacy. The PIs are focusing on two key applications in this work: forensic trace-back and attribution for the purpose of attack deterrence, and defensive data-exfiltration to place precise controls over what kinds of data may move across a network.Broader Impacts: This research is developing key architectural components to improve the level of security and assurance available to network services. In addition, the PIs are initiating a dialogue among both researchers and network operators about critical policy aspects of network security. In particular, information about the sources of both normal and attack traffic that must be safeguarded according to some policy.