CAREER: Programmable Security for Distributed Systems and Databases

对军事、政府和企业网络的系统性攻击凸显了计算机安全的根本重要性。不幸的是，目前的安全方法经常产生不一致的策略和不兼容的机制的临时拼凑。问题有两方面：技术和工具有限，教育项目稀少。研究活动将可配置的安全服务嵌入到用于开发分布式应用程序的编程语言中。这些语言的符号语义将高级访问控制结构映射到基于票据的模型，该模型捕获异构安全策略并支持对安全行为的形式化验证。专门的算法在编译时和运行时为应用程序实现安全证明。一个安全的信息飞地，一个概念验证应用程序，是围绕具有可编程安全策略协调服务的粘合语言构建的。中介从远程站点收集元数据，使用协作策略管理方法来协商安全的互操作性。静态和动态分析保证了飞地的全球政策一致性。教育活动有三个主要重点：发展信息保障教育卓越中心，扩大塔尔萨本科生研究挑战——一个全国公认的为计算机科学专业设计的学术、研究和服务项目，以及在俄克拉荷马州的计算机科学和工程项目中系统地纳入少数民族，特别是印第安人（PI是当地的切罗基人）。

John HaleUniversity of TulsaCCR-9984774ABSTRACT Systematic attacks to military, government and corporate networks underscorethe fundamental importance of computer security. Unfortunately, currentapproaches to security often yield ad hoc patchworks of inconsistent policiesand incompatible mechanisms. The problem is two-fold: Techniques and tools arelimited, and educational programs are sparse. The research activities embed configurable security services withinprogramming languages for developing distributed applications. Denotationalsemantics for these languages map high-level access control structures into aticket-based model that captures heterogeneous security policies and supportsthe formal verification of secure behavior. Specialized algorithms implementsecurity proofs for applications at compile-time and runtime. A secure information enclave, a proof-of-concept application, is builtaround a glue language with programmable security policy coordination services.Mediators gather metadata from remote sites, engaging cooperative policymanagement methods to negotiate secure interoperability. Static and dynamicanalyses guarantee global policy consistency for the enclave. The educational activities have three major thrusts: The development of aCenter of Excellence for Information Assurance Education, the expansion of theTulsa Undergraduate Research Challenge --a nationally recognized program ofacademics, research and service designed for computer science majors, and thesystematic incorporation of minorities, especially Native Americans (the PI is anative Cherokee), in computer science and engineering programs in the state ofOklahoma.