TC: Small: Practical Data Confinement

在当今信息驱动的经济中，组织发现越来越难以控制敏感信息的流动。该项目正在构建一个名为PDC（实用数据约束）的系统，这是一种围绕粗粒度隔离、细粒度动态信息流跟踪（DIFT）和知情策略实施构建的新型信息安全体系结构。从广义上讲，PDC提供了跟踪机密数据移动和强制传播限制的机制，这些限制规定了数据外部化的方式、时间和对象。PDC不需要更改应用程序或操作系统，因此可以在现有的IT环境中轻松部署。PDC使用增强的虚拟机管理程序来强制虚拟机之间的隔离，并仔细跟踪每个虚拟机中虚拟CPU寄存器、内存和磁盘之间敏感数据的移动。管理程序还拦截所有外部可观察到的输出操作（例如，网络通信、向移动存储介质写入数据、向打印机发送数据），并执行安全策略，允许或拒绝将敏感数据外化的特定应用程序请求。当前工作的主要重点是克服过去阻碍类似方法的性能障碍。

In today's information-driven economy, organizations are finding it increasingly difficult to control the flow of sensitive information. This project is building a system called PDC (for Practical Data Confinement), a novel information security architecture built around coarse-grained isolation, fine-grained dynamic information flow tracking (DIFT), and informed policy enforcement. In broad terms, PDC provides mechanisms for tracking the movement of confidential data and enforcing dissemination restrictions that specify how, when, and to whom the data may be externalized. PDC requires no changes to applications or the operating system, and is thus readily deployable in existing IT environments. PDC makes use of an augmented hypervisor that enforces inter-VM isolation and carefully tracks the movement of sensitive data between the virtual CPU registers, memory, and disk within each VM. The hypervisor also intercepts all externally observable output actions (e.g., network communication, writing data to a mobile storage medium, sending data to a printer) and enforces security policies, allowing or denying specific application requests to externalize sensitive data. The main focus of the current work is to overcome the performance barriers that have hindered similar approaches in the past.