SaTC: CORE: Small: Collaborative: Guarding the Integrity of Mobile Graphical User Interfaces

SaTC：核心：小型：协作：保护移动图形用户界面的完整性

• 批准号: 1718702
• 负责人: Felix Xiaozhu Lin
• 金额: $ 25万
• 依托单位: Purdue University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-01 至 2020-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1718702&HistoricalAwards=false
• 关键词: SaTC; CORE; Small; Collaborative; Guarding

Today?s mobile applications and services display information to the user via a Graphical User Interface (GUI). Unfortunately, an attacker may tamper with that display, maliciously hiding, altering, or entirely fabricating display contents. User apps or the cloud services providing the information may be entirely unaware of the tampering. Mobile operating systems, such as Android and iOS, cannot guarantee the integrity and correctness of the app GUI content. This project is developing techniques to guarantee the integrity and correctness of security-sensitive GUI regions, to ensure that what a user sees in those regions is exactly what the app (or cloud service) intends to display. The researchers are developing the concept of a protected GUI region called a "viewport," which a cloud backend may statically associate with an app. The intent is to ensure that only the GUI of the application is able to display into the specified portion of the screen. The researchers are developing a viewport security enforcement monitor, using hardware features of the ARM processor, and developing programming and operating system support for viewports. The project exploits a synergy of hardware features, including virtualization, ARM TrustZone, and modern display controller with support for overlaid layers. Finally, the research team is evaluating the security assurance provided, performance overhead, and ease of use by application developers.

今天好吗?移动应用程序和服务通过图形用户界面（GUI）向用户显示信息。不幸的是，攻击者可能篡改该显示，恶意隐藏、更改或完全伪造显示内容。提供信息的用户应用程序或云服务可能完全不知道这种篡改。Android、iOS等移动操作系统无法保证app GUI内容的完整性和正确性。该项目正在开发技术来保证安全敏感GUI区域的完整性和正确性，以确保用户在这些区域看到的正是应用程序（或云服务）打算显示的内容。研究人员正在开发一个被称为“视口”的受保护GUI区域的概念，云后端可以将其静态地与应用程序关联。其目的是确保只有应用程序的GUI能够显示到屏幕的指定部分。研究人员正在利用ARM处理器的硬件特性开发一种视口安全强制监视器，并开发对视口的编程和操作系统支持。该项目利用了硬件特性的协同作用，包括虚拟化、ARM TrustZone和支持叠加层的现代显示控制器。最后，研究团队正在评估所提供的安全保证、性能开销以及应用程序开发人员的易用性。

项目成果

StreamBox-TZ: Secure Stream Analytics at the Edge with TrustZone

• 发表时间: 2018-08
• 作者: Heejin Park;Shuang Zhai;Long Lu;F. Lin

Power sandbox: power awareness redefined

• DOI: 10.1145/3190508.3190533
• 发表时间: 2018-04
• 期刊: Proceedings of the Thirteenth EuroSys Conference
• 作者: Liwei Guo;Tiantu Xu;Mengwei Xu;Xuanzhe Liu;F. Lin