TC: Small: Collaborative Research: Securing Multilingual Software Systems

点击翻译按钮获取中文摘要

Most real software systems consist of modules developed inmultiple programming languages. Different languages differ in theirsecurity assumptions and guarantees. Consequently, even if singlemodules are secure in some language model and with respect to somesecurity policy, there is usually no uniform security guarantee on awhole multilingual system. This project focuses on low-overheadtechniques for providing security guarantees to software systems inwhich type-safe languages such as Java interoperate with native code.Native code is developed in low-level languages including C, C++, andassembly languages. Although often used in software projects, nativecode is notoriously insecure and is a rich source of securityvulnerabilities. The PIs are developing a two-layered approach toalleviating security threats posed by native code to type-safelanguages: (1) Binary rewriting tools and their verifiers are beingincorporated into the Java Virtual Machine (JVM) for rewriting andverifying native modules at the machine-instruction level to enforcesecurity policies; (2) A safe dialect of C for interoperation withJava is being designed; with the help of programmer annotations, thesafety of programs in this dialect can be statically verified. Theoutcome of this project will enable popular platforms such as the JVMand .NET and other major programming languages (e.g., Python, OCaml,etc.) to incorporate native modules safely. The developed principleswill also be applicable to web browsers and operating systems in whichthere is a need of extending them with untrusted low-level moduleswithout comprising host security.