CT-ISG: Collaborative Research: Trustworthy Enforcement of Domain-independent Run-time Policies

运行时监视器是确保软件和系统遵守安全策略的一种常见且普遍的机制。反病毒和反间谍程序，个人防火墙，入侵检测工具，Java的堆栈检查，甚至是为了显示错误而捕获操作系统异常的机制。蓝屏死机？都可以看作是运行时监视器。尽管它们在复杂性和所能执行的策略范围上有很大的不同，但这些机制都观察运行系统的行为，并检测和响应潜在的危险事件。尽管运行时监视器的普及和现实世界的重要性，它们的使用已经远远超过了理论工作，这使得严格地推断监视器和它们所执行的策略成为可能，特别是在分布式设置中。这个项目开发模型、工具和机制，用于推理和实现分布式的、并发执行的运行时监视器。该研究采用了一种整体的、四管齐下的方法，跨越了执行运行时策略的理论模型和实践系统之间的空间宽度。具体来说，这个项目(1)创建了一个框架，用于推理执行，允许并发，分布式计算的可能性；(2)开发一种类型安全的策略规范语言，确保指定的策略编译成行为良好的监控机制；(3)设计可信算法，将期望的整体策略自动转换为节点特定的策略，这些策略可以在整个网络中分发和执行；(4)设计、实现和测试一个原型系统，用于指定和执行支持并发执行计算的运行时策略。总的来说，这些研究任务支持在并发和分布式设置中对运行时安全策略进行形式化建模和自动执行。

CT-ISG: Collaborative Research: Trustworthy Enforcementof Domain-independent Run-time PoliciesAbstractRun-time monitors are a common and pervasive mechanism for ensuring that software andsystems adhere to security policies. Anti-virus and anti-spyware programs, personal firewalls,intrusion-detection tools, Java's stack inspection, and even mechanisms that trap operatingsystemexceptions in order to show a ?blue screen of death? can all be thought of as run-timemonitors. Although they differ greatly in their complexity and scope of policies that they canenforce, these mechanisms all observe the behavior of a running system and detect and reactto potentially dangerous events. Despite the pervasiveness and real-world importance of runtimemonitors, their use has far outpaced theoretical work that makes it possible to rigorouslyreason about monitors and the policies that they enforce, particularly in distributed settings.This project develops models, tools, and mechanisms for reasoning about and implementingdistributed, concurrently executing run-time monitors. The research adopts a holistic,four-prong approach that spans the breadth of the space between theoretical models andpractical systems for enforcing run-time policies. Specifically, this project (1) creates aframework for reasoning about enforcement that permits the possibilities of concurrent, distributedcomputations; (2) develops a type-safe policy-specification language that ensuresthat specified policies compile into well-behaved monitoring mechanisms; (3) designs trustworthyalgorithms for automatically translating a desired overall policy into node-specificpolicies that can be distributed and enforced throughout a network; and (4) designs, implements,and tests a prototype system for specifying and enforcing run-time policies withsupport for concurrently executing computations. Taken together, these research tasks enableformal modeling and automatic enforcement of run-time security policies in concurrentand distributed settings.