CRII: CSR NeTS: Enabling Secure and Trusted Device I/Os on Smartphones

CRII：CSR NeTS：在智能手机上实现安全且可信的设备 I/O

• 批准号: 1566375
• 负责人: Yifan Zhang
• 金额: $ 17.5万
• 依托单位: SUNY at Binghamton
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-05-01 至 2020-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1566375&HistoricalAwards=false
• 关键词: CRII; CSR; NeTS; Enabling; Secure

The recent success of smartphones is largely due to the integration of various built-in input/output (I/O) devices (e.g., touchscreens, sensors, cameras, and microphones), which not only permit easy interaction between users and smartphones, but also enable a plethora of useful applications. However, these I/O devices, if exploited by attackers, can pose severe security and privacy threats to smartphone users. The root cause of these threats is that smartphone device I/Os carry important and sensitive user information, but currently there lack systematic approaches to protect these device I/Os. This research will investigate the system design and prototype implementation towards enabling secure and trusted device I/Os on smartphones. This project will address the following three objectives with the proposed system, named IOGuard: 1) Securing device inputs: IOGuard aims to secure smartphone device inputs such that attackers cannot infer or steal user sensitive info from device inputs. 2) Enabling trusted device inputs: IOGuard aims to provide protected applications with the guarantee that the device inputs delivered to the applications are authentic and have not been tampered with. 3) Providing trusted screen outputs: IOGuard aims to enable trusted screen outputs for protected applications to defend against UI spoofing/activity hijacking attacks. This project aims at achieving the above objectives with practical and scalable solutions, which support running both unmodified smartphone operating systems and unmodified applications with good system performance and user experience. Specifically, support of unmodified operating systems will be achieved by a small and dedicated bare-metal hypervisor built using the recently introduced ARM hardware virtualization technology. Support of unmodified applications will be achieved by a novel user-space sandbox framework. A series of novel designs will also be carried out and evaluated to enable smooth system integration and good system performance. This project will bring an effective, practical, and deployment-scalable solution that could benefit billions of smartphone users and many mobile services. Besides smartphones, other smart mobile devices that feature a rich set of I/O devices can also benefit from the resulted solution of this research. The understandings, insights, and experiences gained in this project will be extremely valuable to other mobile computing fields that can be benefited from virtualization technologies, such as mobile cloud systems/applications and cyber-foraging.

智能手机最近的成功很大程度上是由于各种内置输入/输出（I/O）设备（例如，触摸屏、传感器、摄像头和麦克风），这不仅允许用户和智能手机之间的轻松交互，而且还实现了大量有用的应用。然而，这些I/O设备如果被攻击者利用，可能会对智能手机用户造成严重的安全和隐私威胁。这些威胁的根本原因是，智能手机设备I/O进行重要和敏感的用户信息，但目前缺乏系统的方法来保护这些设备I/O。本研究将调查系统的设计和原型实现，使智能手机上的安全和可信的设备I/O。该项目将通过所提议的名为IOGuard的系统实现以下三个目标：1）保护设备输入：IOGuard旨在保护智能手机设备输入，使攻击者无法从设备输入中推断或窃取用户敏感信息。2)启用可信设备输入：IOGuard旨在为受保护的应用程序提供保证，确保交付给应用程序的设备输入是真实的，没有被篡改。3)提供可信的屏幕输出：IOGuard旨在为受保护的应用程序提供可信的屏幕输出，以抵御UI欺骗/活动劫持攻击。该项目旨在通过实用和可扩展的解决方案实现上述目标，这些解决方案支持运行未经修改的智能手机操作系统和未经修改的应用程序，并具有良好的系统性能和用户体验。具体来说，对未修改的操作系统的支持将通过使用最近推出的ARM硬件虚拟化技术构建的小型专用裸金属管理程序来实现。对未经修改的应用程序的支持将通过一个新的用户空间沙箱框架来实现。一系列新颖的设计也将进行和评估，使顺利的系统集成和良好的系统性能。 该项目将带来一个有效、实用和可扩展的解决方案，可以使数十亿智能手机用户和许多移动的服务受益。除了智能手机，其他智能移动的设备，具有丰富的I/O设备集也可以受益于本研究的解决方案。在该项目中获得的理解、见解和经验对于可以从虚拟化技术中受益的其他移动的计算领域（例如移动的云系统/应用程序和网络搜寻）来说非常有价值。