CAREER: Language-based Distributed System Security

CNS-0346939 CAREER：基于数据库的分布式系统安全Stephan A.分布式系统是现代计算基础设施中越来越重要的一部分，但现有的技术缺乏确保其安全性和可靠性。 本研究解决了构建分布式系统的问题，并通过开发编程语言来推理其安全性，这些编程语言为描述安全策略和通信协议提供了更好的抽象。 这个项目的出发点是现有的安全类型语言的工作，它保护数据的机密性和完整性。 这项研究概括了这些信息流策略，使它们更具动态性，使它们能够适应分布式系统运行的不断变化的环境。 例如，动态信息流策略应该与传统的身份验证和访问控制机制干净地结合起来，以提供端到端的保密保证。该项目的第二阶段是开发将动态安全策略应用于分布式程序的语言技术。这部分研究的想法是开发一个理论基础，为安全的分布式计算使用现有的进程calculi增强了异构的信任模型和上述的政策语言。 在这种设置中，类型描述通信协议，其属性可以由编译器静态验证。 其结果将是一种具有良好类型规范的编程语言，有助于程序员编写正确的、安全关键的分布式程序。

CNS-0346939CAREER: Language-based Distributed System SecurityStephan A. ZdancewicDistributed systems are an increasingly crucial part of moderncomputing infrastructure, yet the existing technology for ensuringtheir security and reliability is lacking. This research addressesthe problem of building distributed systems and reasoning about theirsecurity by developing programming languages that provide betterabstractions for describing security policies and communicationprotocols. The starting point for this project is existing work on security-typedlanguages, which protect data confidentiality and integrity. Thisresearch generalizes these information-flow policies to make them moredynamic, enabling them to accommodate the changing environment in whichdistributed systems run. For example, dynamic information-flowpolicies should integrate cleanly with traditional authentication andaccess control mechanisms to provide end-to-end guarantees about dataconfidentiality.The second stage of this project is to develop language technologythat applies dynamic security policies to distributed programs. Theidea for this part of the research is to develop a theoretical basisfor secure distributed computing using existing process calculiaugmented with a heterogeneous trust model and the policy languageoutlined above. In this setting, types describe communicationprotocols, properties of which can be verified statically by thecompiler. The result will be a programming language with a sound typesystem that aids the programmer in writing correct, security-criticaldistributed programs.