Scalable Large-Scale Precise System-Wide Data-Driven Usage Control Across Layers of Abstraction and Across Machines

使用控制要求规定了访问数据后对数据使用的限制（“三天内删除”、“不复制”）。然而，在分布式环境中，一旦数据泄露，通常就失去了对数据的控制。该项目的目标是在运行时强制执行，或者至少检测违反这类属性的行为。现有的方法集中在一个具体的数据表示上，例如，一个文件。在这个项目中，寻求一个独立于表示的解决方案。为此目的，参考监视器的现有概念- -通常是为技术事件定义的- -将首先通过数据流检测加以扩展：对文件的删除要求也将适用于该文件的所有副本，因此必须跟踪该文件的存在。其次，将提供一个框架，用于在不同抽象层次上定义精确的技术机器级语义：“复制”意味着复制文件，在Excel中复制和粘贴，以及发送电子邮件。第三，为了执行数据驱动的使用控制策略，在不同的抽象级别（例如，操作系统、运行时系统、窗口系统、独立的IT系统）上定义了引用监视器。数据流不仅在这些级别上被监控，而且在这些级别之间也被监控。例如，在禁止“复制”的严格解释下，如果想要最终禁止复制和粘贴，则必须跟踪数据从文件通过操作系统通过Java VM到本机显示功能的路径

Usage control requirements stipulate constraints on the usage of data after access to them (“de-lete within three days,” “don’t copy.“) Control over data is, however, usually lost in distributed settings once the data is given away.The goal of the project is the run-time enforcement or at least the detection of violation of this kind of properties. Existing approaches focus on one concrete data representation, e.g., a file. In this project, a representation-independent solution is sought. To this end, existing concepts for reference monitors – that are usually defined for technical events – will, firstly, be extended by data flow detection: A deletion requirement for a file will then pertain to all copies of that file as well, the existence of which must hence be tracked. Secondly, a framework for the definition of precise technical machine-level semantics at different levels of abstraction will be provided: “copy” means, among other things, copy a file, copy&paste in Excel, and sending an email. To enforce data-driven usage control policies, reference monitors are, thirdly, defined at different levels of abstraction (e.g., operating system, runtime system, windowing system, separate IT system). Data flows will not only be monitored at each of these levels, but also in-between lev-els. For instance, under a strict interpretation of a prohibition to “copy,” the data’s path from a file through the operating system through the Java VM to native display functions must be tracked if one wants to, finally, prohibit copy&paste