TC: Small: Protection Mechanisms for Portable Storage

像USB闪存驱动器这样的便携式存储设备在日常生活中几乎无处不在。它们对大学里的学生和在战场上传输数据的士兵一样有用。然而，使用这些设备带来的安全风险实在是太真实了：在闪存驱动器上的恶意代码感染了操作网络后，大量机密数据被泄露，随后被发布到维基解密上，美国国防部禁止了这些设备。这些事件暴露的安全漏洞所引起的关注远远超出了军事领域，并扩展到便携式存储设备的任何用户。虽然已经进行了许多尝试来保护主机免受恶意设备的攻击，但很少有研究考虑到确保敏感数据免受潜在受损主机保护的对称问题，也没有考虑USB总线本身的安全性。该项目研究了导致便携式存储设备易受攻击的因素，并考虑了一个新的框架来建模和评估这些设备的安全性。我们将考虑存储设备本身、它们所连接的主机以及传输数据的USB接口的安全性。我们考虑监控附加主机完整性的方法，并研究如何建立和管理主机身份。我们提出了基于这些设备的应用程序，例如维护存储数据的来源和取证信息，以及支持信息流的新框架，以进一步实施细粒度访问保护。这些进步将确保闪存驱动器和它们连接的主机保持安全。

Portable storage devices such as USB flash drives have become virtually ubiquitous in daily life. They are as useful to students in college as to a soldier transferring data in a combat theater. However, the security risks posed by using these devices are all too real: after malicious code on a flash drive infected operational networks, allowing a mass exfiltration of classified data subsequently posted to Wikileaks, the Department of Defense banned these devices. The security vulnerabilities exposed by these events are of concern far beyond the military and extend to any user of portable storage. While numerous attempts have been made to secure hosts from malicious devices, very little research has considered the symmetrical problem of ensuring the protection of sensitive data from potentially compromised hosts, nor the security of the USB bus itself.This project examines the factors contributing to the vulnerability of portable storage devices and consider a new framework for modeling and evaluating the security of these devices. We will consider the security of the storage devices themselves, the hosts they attach to, and the USB interface that transports the data. We consider methods of monitoring the integrity of attached hosts, and examine how to establish and manage host identity. We propose applications based on these devices, such as maintaining provenance and forensic information on stored data, and new frameworks supporting information flow for further enforcing finer-grained access protections. Such advances will ensure that flash drives and hosts they attach to remain safe and secure.