CAREER: Securing Applications From Compromised System Software

在理想的情况下，安全软件应该被构建为一组相互不信任的组件，这些组件协同工作以实现目标。然而，现代软件不是以这种方式构建的；相反，它非常信任称为操作系统内核的组件。幸运的是，有了新的方法来隔离程序之间以及与操作系统内核之间的隔离，以最大限度地减少攻击者破坏关键组件所造成的损害。然而，这样的解决方案速度太慢，而且容易受到复杂的隐式信息流攻击。此外，将使用正式验证技术来验证当前解决方案的有效性。该项目将开发新的技术来解决这些不足。它将调查新硬件机制的使用，这些机制将加快保护应用程序免受受危害的商用操作系统内核的影响。它将开发新的编译器转换，修改现有软件以不信任其他软件组件。它将设计新的静态信息流分析方法和运行时检查，以防止被攻击的操作系统内核窃取应用程序机密，并通过Iago攻击影响应用程序行为。最后，该项目将建立系统的正式模型，并证明它按预期保护软件。该项目将发布开源软件，以便这些技术和工具可以被其他研究人员使用，并能够找到实践的途径。在教育方面，操作系统设计人员的课程将包含设计人员正在构建操作系统时这类重要攻击的知识。

In an ideal world, secure software would be built as a set of mutually distrusting components that work together to accomplish goals. However, modern software is not built this way; rather, it heavily trusts a component called the operating system kernel. Fortunately, there are new methods of isolating programs from each other and from the OS kernel to minimize the damage caused if an attacker compromises a critical component. However, such solutions are too slow and are vulnerable to sophisticated implicit information flow attacks. Also, the effectiveness of current solutions will be verified using formal verification techniques.This project will develop new techniques to solve these deficiencies. It will investigate the use of new hardware mechanisms that will accelerate the protection of applications from compromised commodity operating system kernels. It will develop new compiler transformations that will modify existing software to distrust other software components. It will devise new static information flow analysis methods and run-time checks to keep compromised operating system kernels from stealing application secrets and influencing application behaviors through Iago attacks. Finally, the project will build a formal model of the system and prove that it protects software as intended. The project will release open source software so that the techniques and tools can be used by other researchers and can find their way into practice. Educationally, curriculum for OS designers will contain knowledge of this important class of attacks at the point that designers are building the OS.