End-to-end Integrity and Confidentiality for Distributed Systems

当前的趋势是，通过网络连接的分布式组件（包括不可信的客户机）构建计算基础设施，因此提供安全和隐私保证变得越来越困难。对于这种保证很重要的是分布式系统的机密性和完整性，这些系统为彼此之间信任不完全的主体提供服务。这一描述包括临床信息系统、联合军事信息系统和金融信息系统。一种新的安全机制，即安全程序分区，可以提供更强的端到端保证，确保数据的机密性。在这种方法中，程序根据强大的安全策略进行转换，从而产生安全的分布式系统。这是在包括不受信任的、可能是恶意的主机在内的环境中指定和执行机密性和完整性的一种有吸引力的方法。由于分布式计算和数据的完整性难以在不可信主机存在的情况下保持，本研究探讨了将安全程序分区扩展到用户冗余计算以保持完整性的方法。此外，由于当前并发系统的安全理论和实践是限制性的，而且还不健全，因此正在探索并发系统中新的信息流模型。这一点尤其重要，因为分布式系统天生是并发的。这些问题的解决方案正在作为Jif语言系统的一部分实现。

Providing assurance of security and privacy is becoming more difficult with current trends towards building computing infrastructure out of distributed components connected by networks, including untrusted client machines. Important to this assurance are the confidentiality and integrity properties of distributed systems that serve principals whose trust in each other is incomplete. This description encompasses, among others, clinical information systems, joint military informationsystems, and financial information systems.A new security mechanism, secure program partitioning, can provide stronger, end-to-end assurance that data remains confidential. In this approach, programs are transformed according to strong securitypolicies, resulting in secure distributed systems. This is an attractive way to specify and enforce confidentiality and integrity in environments that include untrusted, possibly malicious host machines.Because the integrity of distributed computations and data is difficult to maintain in the presence of untrusted hosts, this research investigates an extension of secure program partitioning to useredundant computation to preserve integrity. In addition, new models of information flow in concurrent systems are being explored because the current theory and practice of security for concurrent systems isrestrictive, yet also unsound. This is especially important because distributed systems are naturally concurrent. Solutions to these problems are being implemented as part of the Jif language system.