An Information Flow Approach to Data Security

点击翻译按钮获取中文摘要

In the past, computer security practitioners were largely concerned with defending against hackers, malware, worms and bots, whose purpose was to get malicious code running on victim machines and steal the victim's computing resources. However, modern computer systems are so complex that securing them seems nearly impossible -- barely a month goes by without a security breach making headlines. This grim reality will give rise to a fundamental change in computer security. The falling cost of computing hardware means that security breaches of computing resources are less costly. Rather, it is the valuable data kept on computers that must be protected. Because of this, the next few years will see the transformation of computer security from a resource-protection problem to a data-protection problem. The main problem this proposal will address is the protection of digital data in spite of computer systems compromises. To do this, this proposal will revisit an old idea - information flow tracking and control, which has long been used to protect high-cost military systems. The key challenge this proposal will address, will be to show that how information flow can be practically applied to a variety commodity computer systems used by individual users and average businesses. We will investigate the use of information flow on a variety of modern computing systems, from tiny smart phones to massive clouds of servers. If successful, this research will pave the way to a world where the average user can be assured that their digital data is safe from security breaches.