CSR: Small: An Information Accountability Architecture for Distributed Enterprise Systems

CSR：小型：分布式企业系统的信息责任架构

• 批准号: 0914312
• 负责人: Michail Polychronakis
• 金额: $ 45万
• 依托单位: Columbia University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-01 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0914312&HistoricalAwards=false
• 关键词: CSR; Small; Information; Accountability; Architecture

Personally identifiable or sensitive information (PII) has become a target of attackers seeking financial gain through its misuse. With the trend toward storing and processing PII on complex and insecure systems, the need for improved protection has become a goal of enterprise policy and legislative efforts. In this project, we investigate Concatenated Dynamic Information Flow Tracking (CDIFT), an architecture for performing dynamic information flow analysis at various system levels and across multiple processes in a distributed enterprise. CDIFT will allow administrators to ?map? the enterprise business logic (applications, network, storage) and determine where information of interest is stored or transmitted. The same mechanism can also be used to enforce an information flow policy, restricting where and by whom such information can be viewed. CDIFT will complement and enhance current compliance and auditing efforts, which require considerable recurrent effort and a large number of man-hours spent by administrators and auditors on understanding existing systems.We will develop and experimentally evaluate novel techniques for conducting fine-grained tracking of information of interest (as defined by the system operator or, in the future, by end-users, in a flexible, context-sensitive manner) toward mapping the paths that such information takes through the enterprise and providing a means for enforcing information flow and access control policies. Our hypothesis is that it is possible to create efficient fine-grained information tracking and access control mechanisms that operate throughout an enterprise legacy computing infrastructure through appropriate use of hypervisors and distributed tag propagation protocols.

个人可识别或敏感信息（PII）已成为攻击者的目标，他们通过滥用这些信息来寻求经济利益。随着在复杂和不安全的系统上存储和处理PII的趋势，对改进保护的需求已成为企业策略和立法工作的目标。在这个项目中，我们调查级联动态信息流跟踪（CDIFT），在分布式企业中的多个系统级别和多个流程执行动态信息流分析的架构。CDIFT将允许管理员？地图？企业业务逻辑（应用程序、网络、存储），并确定感兴趣的信息存储或传输的位置。同样的机制也可以用来实施信息流策略，限制在何处以及由谁可以查看这些信息。CDIFT将补充和增强当前的合规和审计工作，这需要管理员和审计员花费大量的经常性工作和大量工时来了解现有系统。我们将开发并实验评估用于进行细粒度跟踪的新技术感兴趣的信息（如de& #64257;由系统操作员或将来由终端用户以灵活的上下文敏感的方式设定），以映射这样的信息通过企业所采用的路径，并提供用于实施信息&流和访问控制策略的手段。我们的假设是，有可能创建有效的细粒度的信息跟踪和访问控制机制，通过适当使用虚拟机管理程序和分布式标签传播协议，在整个企业的传统计算基础设施。