CAREER: User-Space Protection Domains for Compositional Information Security

对电子邮件阅读器和Web浏览器等软件应用程序的攻击很常见。这些攻击可能会造成从应用程序故障、私人数据丢失到完全接管用户计算机的损害。 一个有效的策略是在应用程序设计中采用最小特权原则：将应用程序划分为几个保护域，每个域只被赋予执行其任务所需的特权。在这种设计中，一个域的危害不会直接导致其他安全敏感域的危害。 PI建议设计和实现一个框架，使软件开发人员能够轻松地将最小特权原则应用于他们的应用程序。拟议的框架将大大提高关键软件应用程序的安全性。该研究结合了几个新颖的思想：（1）通过二进制级别的隔离和信息流安全的实施来实现用户空间保护域;（2）允许灵活配置应用程序安全架构的声明性语言;（3）二进制级别的分区工具，自动将应用程序划分为最低权限的组件;（4）组合推理机制，允许开发人员对应用程序的端到端信息安全执行正式推理。 通过停留在用户空间中，所提出的框架是独立于操作系统的，并且通过处理二进制代码，它是源语言不可知的，使其具有更广泛的适用性。 开发人员可以使用它来划分应用程序，灵活地配置其安全架构，并考虑其信息安全性。 在教育方面，PI将组织一系列活动，以提高高中生的安全意识，隐私和安全编程。 中心活动是一个夏季研讨会，聚集当地高中技术教师，帮助他们设计可以融入学校技术课程的课程计划。

Attacks on software applications such as email readers and web browsers are common. These attacks can cause damages ranging from application malfunction, loss of private data, to a complete takeover of users' computers. One effective strategy for limiting the damage is to adopt the principle of least privilege in application design: the application is split into several protection domains and each domain is given only the necessary privileges to perform its task. In this design, the compromise of one domain does not directly lead to the compromise of other security-sensitive domains. The PI proposes to design and implement a framework that makes it easy for software developers to apply the principle of least privilege to their applications. The proposed framework will significantly improve the security of critical software applications. It will benefit the software industry by designing new technologies for building secure software systems.The proposed research combines several novel ideas: (1) user-space protection domains through binary-level enforcement of isolation and information-flow security; (2) a declarative language that allows for flexible configuration of an application's security architecture; (3) a binary-level partitioning tool that automatically splits an application into components of least privilege; (4) a compositional reasoning mechanism that allows developers to perform formal reasoning about an application's end-to-end information security. By staying in the user space, the proposed framework is OS independent, and by working on binary code, it is source-language agnostic, making it more broadly applicable. Developers can use it to partition an application, flexibly configure its security architecture, and reason about its information security. On the education side, the PI will organize a series of activities to increase high school students' awareness of security, privacy, and secure programming. The central activity is a summer workshop that gathers local high-school technology teachers and helps them design lesson plans that can be integrated into their schools' technology curriculum.