SHF: Small: Collaborative Research: Beyond Secure Processors - Securing Systems Against Hardware

SHF：小型：协作研究：超越安全处理器 - 保护系统免受硬件攻击

• 批准号: 0915501
• 负责人: Yan Solihin
• 金额: $ 23.02万
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-15 至 2014-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915501&HistoricalAwards=false
• 关键词: SHF; Small; Collaborative; Research; Beyond

Computer systems are increasingly located in places, where they can be physically accessed by people who are not authorized to have unrestricted control of and access to these systems. Examples of this include company laptops carried by employees, robotic vehicles, gaming consoles with copyright protection mechanisms, and remote users of servers in data-centers. An emerging threat in such scenarios are hardware attacks, where snooping devices are attached to the system to directly read and/or modify data within the system. These attacks can circumvent all traditional security protections in the system, such as password checks, access permissions for data files, etc.To address these threats, researchers and processor makers have proposed or developed various types of secure processor architectures, which encrypt and continuously verify data in the system?s memory. However, these secure processors are far from being ready for widespread use, primarily because they focus on a single-processor, non-mobile system that is already up and running and executing a single application. This research project will investigate how to overcome these limitations, focusing on mechanisms for secure boot-up and system configuration, secure communication between and migration of applications, secure access to peripheral devices (including the network). In essence, this project will build the intellectual framework that will be needed to make computers secure regardless of their physical location, preventing unauthorized access even if the system is captured, stolen, or actually owned by a potentially malicious entity. Other broader impacts of this project include improvements in education and workforce, by making computer hardware designers more aware of physical security and by making computer security experts more aware of implications of physical (hardware) attacks.

计算机系统越来越多地位于这样的地方，在这些地方，它们可以被未被授权对这些系统进行无限制控制和访问的人物理访问。这方面的例子包括员工携带的公司笔记本电脑、机器人车辆、具有版权保护机制的游戏机以及数据中心服务器的远程用户。这种情况下出现的威胁是硬件攻击，其中窥探设备连接到系统以直接读取和/或修改系统内的数据。这些攻击可以规避系统中所有传统的安全保护措施，如密码检查、数据文件的访问权限等。为了解决这些威胁，研究人员和处理器制造商提出或开发了各种类型的安全处理器架构，它们对系统中的数据进行加密和持续验证？的记忆。然而，这些安全处理器远未准备好广泛使用，主要是因为它们专注于已经启动并运行并执行单个应用程序的单处理器非移动系统。本研究项目将研究如何克服这些限制，重点是安全启动和系统配置，应用程序之间的安全通信和迁移，安全访问外围设备（包括网络）的机制。从本质上讲，该项目将建立使计算机安全所需的知识框架，无论其物理位置如何，即使系统被捕获，被盗或实际上由潜在的恶意实体拥有，也可以防止未经授权的访问。该项目的其他更广泛的影响包括教育和劳动力的改善，使计算机硬件设计师更加意识到物理安全，并使计算机安全专家更加意识到物理（硬件）攻击的影响。