权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

CAREER: Secure OS Views for Modern Computing Platforms

职业：现代计算平台的安全操作系统视图

基本信息

批准号：
1253346
负责人：
William Enck
金额：
$ 40万
依托单位：
North Carolina State University
依托单位国家：
美国
项目类别：
Continuing Grant
财政年份：
2013
资助国家：
美国
起止时间：
2013-02-01 至 2019-01-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=1253346&HistoricalAwards=false
关键词：
CAREER Secure OS Views Modern

项目摘要

The security architecture of consumer operating systems is currently undergoing a fundamental change. In platforms such as Android, iOS, and Windows 8, each application is a separate security principal that can own data. While this distinction is a vast improvement over traditional user-focused security architectures, sharing data between applications results in an unexpected loss of control of that data, potentially exposing security and privacy sensitive information. This research improves the security of these modern consumer operating systems by providing a holistic view of data protection. In particular, this work proposes a new operating system abstraction for transparently tracking and controlling access to all data, allowing policy to determine if a reader is given the true value, a fake or modified value, or no value at all. To efficiently and practically accomplish this goal, this work combines several existing and new techniques to track and control access to data. The new abstraction provided by this work not only solves a significant problem affecting modern consumer operating systems by enabling applications to retain pervasive control over their data, but also more broadly provides a new abstraction on which a variety of new security solutions can be built.

消费者操作系统的安全体系结构目前正在经历根本性的变化。在Android、iOS和Windows 8等平台中，每个应用程序都是一个独立的安全主体，可以拥有数据。虽然这一区别是对传统的以用户为中心的安全体系结构的巨大改进，但在应用程序之间共享数据会导致意外地失去对数据的控制，可能会暴露安全和隐私敏感信息。这项研究通过提供数据保护的整体视图，提高了这些现代消费者操作系统的安全性。特别是，这项工作提出了一种新的操作系统抽象，用于透明地跟踪和控制对所有数据的访问，允许策略确定是否向读者提供真值、假值或修改值，或者根本没有值。为了有效和实际地实现这一目标，这项工作结合了几种现有的和新的技术来跟踪和控制对数据的访问。这项工作提供的新抽象不仅通过使应用程序能够保持对其数据的普遍控制来解决影响现代消费者操作系统的重大问题，而且更广泛地提供了一种新的抽象，可以在此基础上构建各种新的安全解决方案。