CAREER: Improving Software Assurance Using Transactions

这个CAREER项目的目标是开发使用事务来改进软件保证的新机制。这个项目正在开发事务性内存内省（transactional Memory Introspection，简称TMI），这是一种通过利用硬件和软件事务性内存的最新进展来构建软件安全机制的方法。基于TMI的安全机制建立在事务性内存系统用来确保性能和功能的相同机制之上。因此，TMI承诺使安全机制高效且易于与软件集成。本项目研究的基于tmi的安全机制包括：(1)TxAuth：一种参考监控架构，可以更好地确保安全敏感操作的完成，并允许更容易地与遗留系统集成；(2) TxInt：数据结构完整性监视器，保护可扩展的软件系统，如操作系统和浏览器，不受不受信任的扩展；(3) TMWatch：一个数据观察点框架，为恶意软件分析工具和调试器配备了新的功能，以逆向工程恶意软件行为。更广泛地说，这个项目试图证明在事务性内存系统中实现的并发控制机制也可以用于改进软件保证。这些额外的好处可能会导致对事务进行更多的研究，并最终被硬件和软件供应商采用。这个项目的成果正在通过开发新的课程材料进行传播，这些材料将使学生和软件供应商了解安全编程的注意事项。在这个项目中开发的合适的课程材料也被包括在针对K-12和本科生的课程中，以吸引他们学习计算机科学课程。

he goal of this CAREER project is to develop novel mechanisms that usetransactions to improve software assurance. This project is developingTransactional Memory Introspection---or TMI, which is an approach to building software security mechanisms by leveraging recent advances in hardware and software transactional memory. Security mechanisms based on TMI build upon the same machinery that transactional memory systems use to ensure performance and functionality. TMI therefore promises to make security mechanisms efficient and easy to integrate with software.TMI-based security mechanisms being researched in this project include:(1) TxAuth: a reference monitor architecture to better ensure completemediation of security-sensitive operations and allow easier integration with legacy systems;(2) TxInt: a data structure integrity monitor to protect extensible software systems, such as operating systems and browsers, from untrusted extensions; and(3) TMWatch: a data watchpoint framework that equips malware analysis tools and debuggers with new capabilities to reverse-engineer malware behavior.More broadly, this project seeks to demonstrate that concurrency controlmachinery implemented in transactional memory systems can also be used to improve software assurance. These additional benefits may lead to more research on transactions and their ultimate adoption by hardware and software vendors. The results from this project are being disseminated via the development of new course material that will expose students and software vendors to the dos and don'ts of secure programming. Suitable course material developed in this project is also being included in courses targeted towards K-12 and undergraduate students to attractthem to computer science programs.