An Information Flow Approach to Data Security

在过去，计算机安全从业者主要关注防御黑客，恶意软件，蠕虫和机器人，其目的是让恶意代码在受害者机器上运行并窃取受害者的计算资源。然而，现代计算机系统是如此复杂，以至于保护它们似乎几乎是不可能的-几乎每个月都有安全漏洞成为头条新闻。 这一严峻的现实将引起计算机安全的根本性变化。 计算硬件成本的下降意味着计算资源的安全漏洞成本更低。 相反，必须保护的是保存在计算机上的有价值的数据。 正因为如此，未来几年将看到计算机安全从资源保护问题转变为数据保护问题。 这项建议将解决的主要问题是，尽管计算机系统受到损害，但仍要保护数字数据。 为此，该提案将重新审视一个古老的想法--信息流跟踪和控制，这一想法长期以来一直被用于保护高成本的军事系统。 这一建议将解决的关键挑战是，如何将信息流实际应用于个人用户和普通企业使用的各种商品计算机系统。 我们将研究信息流在各种现代计算系统上的使用，从小型智能手机到大型云服务器。 如果成功，这项研究将为一个普通用户可以确保其数字数据安全免受安全漏洞侵害的世界铺平道路。

In the past, computer security practitioners were largely concerned with defending against hackers, malware, worms and bots, whose purpose was to get malicious code running on victim machines and steal the victim's computing resources. However, modern computer systems are so complex that securing them seems nearly impossible -- barely a month goes by without a security breach making headlines. This grim reality will give rise to a fundamental change in computer security. The falling cost of computing hardware means that security breaches of computing resources are less costly. Rather, it is the valuable data kept on computers that must be protected. Because of this, the next few years will see the transformation of computer security from a resource-protection problem to a data-protection problem. The main problem this proposal will address is the protection of digital data in spite of computer systems compromises. To do this, this proposal will revisit an old idea - information flow tracking and control, which has long been used to protect high-cost military systems. The key challenge this proposal will address, will be to show that how information flow can be practically applied to a variety commodity computer systems used by individual users and average businesses. We will investigate the use of information flow on a variety of modern computing systems, from tiny smart phones to massive clouds of servers. If successful, this research will pave the way to a world where the average user can be assured that their digital data is safe from security breaches.