CICI: UCSS: Helix++: Securing Open Science Platforms

Helix++项目的目标是使用最近开发的、有前途的网络安全研究成果来保护开放科学平台。确保这些开放科学平台的安全至关重要，因为研究基础设施的损害可能会产生严重的后果，包括关键研究的延迟、研究结果的腐败、知识产权被盗以及个人身份信息的暴露。除了为研究人员提供定制的、安全的广泛使用的开放软件包外，Helix++项目还将为未来的研究和保护关键网络基础设施的战略提供见解和方向。利用弗吉尼亚大学现有的两个可操作的开放科学平台，该项目将调查对基础设施保护至关重要的技术和政策问题的相互作用。开源Helix++项目通过应用尖端网络安全技术来自动多样化和强化软件，改善了开放科学平台的安全态势。Helix++的一个显著特点是它不需要源代码或构建构件。它直接在二进制形式的软件上操作--甚至是剥离的可执行文件和库。此功能非常关键，因为从源代码重新构建应用程序是一个耗时且往往令人沮丧的过程。Helix++支持快速生成和部署安全容器和虚拟机，其中各种应用程序和库被转换为包含Helix++保护。多样化打破了软件的单一文化，使攻击更难执行，因为成功攻击所需的信息将发生不可预测的变化。多样化还迫使攻击者为每个目标定制一次攻击，而不是攻击者精心设计一个在所有类似配置的目标上可靠工作的漏洞。强化直接针对关键攻击类别。多样性和硬化性的结合提供了纵深防御，以及移动目标防御。Helix++在两个开放科学平台上进行了评估，以展示其有效性和可用性。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The Helix++ project’s goal is to use recently developed, promising cybersecurity research results to secure open-science platforms. Securing these open-science platforms is vital because compromise of research infrastructure can have severe consequences, including the delay of critical research, corruption of research results, theft of intellectual property, and exposure of personally identifiable information. Beyond providing researchers customized, secure packages of widely used open software, the Helix++ project will provide insights and directions for future research and strategies for protecting critical cyber infrastructure. Using two existing operational open-science platforms at the University of Virginia, the project will investigate the interaction of technical and policy issues which are fundamental to infrastructure protection.The open-source Helix++ project improves the security posture of open science platforms by applying cutting-edge cybersecurity techniques to diversify and harden software automatically. A distinguishing feature of Helix++ is that it does not require source code or build artifacts. It operates directly on software in binary form—even stripped executables and libraries. This feature is key as rebuilding applications from source is a time-consuming and often frustrating process. Helix++ enables the rapid generation and deployment of secure containers and virtual machines, wherein various applications and libraries are transformed to incorporate the Helix++ protections. Diversification breaks the software monoculture and makes attacks harder to execute as information needed for a successful attack will have changed unpredictably. Diversification also forces attackers to customize an attack for each target instead of attackers crafting an exploit that works reliably on all similarly configured targets. Hardening directly targets key attack classes. The combination of diversity and hardening provides defense-in-depth, as well as a moving target defense. Helix++ is evaluated on two open science platforms to demonstrate its efficacy and usability.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.