SHF: Small: Collaborative Research: Beyond Secure Processors - Securing Systems Against Hardware Attacks

SHF：小型：协作研究：超越安全处理器 - 保护系统免受硬件攻击

• 批准号: 0916464
• 负责人: Milos Prvulovic
• 金额: $ 25.91万
• 依托单位: Georgia Tech Research Corporation
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-15 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0916464&HistoricalAwards=false
• 关键词: SHF; Small; Collaborative; Research; Beyond

Computer systems are increasingly located in places, where they can be physically accessed by people who are not authorized to have unrestricted control of and access to these systems. Examples of this include company laptops carried by employees, robotic vehicles, gaming consoles with copyright protection mechanisms, and remote users of servers in data-centers. An emerging threat in such scenarios are hardware attacks, where snooping devices are attached to the system to directly read and/or modify data within the system. These attacks can circumvent all traditional security protections in the system, such as password checks, access permissions for data files, etc.To address these threats, researchers and processor makers have proposed or developed various types of secure processor architectures, which encrypt and continuously verify data in the system?s memory. However, these secure processors are far from being ready for widespread use, primarily because they focus on a single-processor, non-mobile system that is already up and running and executing a single application. This research project will investigate how to overcome these limitations, focusing on mechanisms for secure boot-up and system configuration, secure communication between and migration of applications, secure access to peripheral devices (including the network). In essence, this project will build the intellectual framework that will be needed to make computers secure regardless of their physical location, preventing unauthorized access even if the system is captured, stolen, or actually owned by a potentially malicious entity. Other broader impacts of this project include improvements in education and workforce, by making computer hardware designers more aware of physical security and by making computer security experts more aware of implications of physical (hardware) attacks.

计算机系统越来越多地位于那些无权不受限制地控制和访问这些系统的人可以物理访问的地方。这方面的例子包括员工携带的公司笔记本电脑、机器人车辆、具有版权保护机制的游戏机以及数据中心服务器的远程用户。这种情况下的新威胁是硬件攻击，其中监听设备连接到系统以直接读取和/或修改系统内的数据。这些攻击可以绕过系统中所有传统的安全保护措施，例如密码检查、数据文件的访问权限等。为了应对这些威胁，研究人员和处理器制造商提出或​​开发了各种类型的安全处理器架构，这些架构对系统内存中的数据进行加密并持续验证。然而，这些安全处理器还远未准备好广泛使用，主要是因为它们专注于已经启动、运行并执行单个应用程序的单处理器、非移动系统。该研究项目将研究如何克服这些限制，重点关注安全启动和系统配置的机制、应用程序之间的安全通信和迁移、外围设备（包括网络）的安全访问。从本质上讲，该项目将构建一个智能框架，使计算机无论物理位置如何都保持安全，即使系统被潜在恶意实体捕获、盗窃或实际拥有，也能防止未经授权的访问。该项目的其他更广泛的影响包括教育和劳动力的改善，使计算机硬件设计人员更加了解物理安全，并使计算机安全专家更加了解物理（硬件）攻击的影响。