CNS Core: Small: eXecution Graph Path Security (XGPS)

Execution Graph Path Security(XGPS)是一种新的计算机处理器，可以限制常见的低级行为，使攻击者无法使用它们来控制系统。通过将通用控制操作替换为新的有限操作，XGPS将在保留预期功能的同时防止常见的攻击者步骤。这一点很重要，因为几乎所有的计算系统都容易受到攻击。现有方法强调一般硬件保护，但在防御中留下漏洞，无法在程序执行时轻松跟踪。核心挑战和想法是描述、跟踪和确保硬件本身的良好行为。XGPS观察到，几乎所有安全策略在包括程序路径描述时都更加精确。XGPS将开发一种新的硬件机制来表示、跟踪和保护所有程序路径，包括操作系统。第一个推力将开发一种通用数据结构，该结构能够在大小有限的情况下表示程序路径。第二个推力将在硬件中实施路径，同时保护其不受管理级别的危害。第三个推力将开发新的基于有效路径的硬件/软件安全策略，展示路径的有效性，以强制执行有意义的属性。这项研究的最终结果将是增强对系统的理解和开发，并对程序行为进行严格控制。通过控制这一行为，XGPS将拒绝大类威胁，如果采用，将导致显著更强大的可信计算基础。此外，XGPS将使现有硬件能够解决更适合其能力的问题。这项研究计划的一个核心要素将是通过课程、指导和实践研究活动吸引研究生和本科生。该项目将积极吸引未被充分代表的少数民族学生进行研究和安全技术教育。这项工作的结果将是核心组件的高级模型、基于硬件的设计和实现、书面报告和实验数据。所有文物将保存在https://fiercelab.cs.rice.edu/projects/xgps/，并在项目结束后维护三年。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

eXecution Graph Path Security (XGPS) is a new computer processor that restricts common low-level behaviors so that attackers cannot use them to take control of a system. By replacing general purpose control operations with new limited operations, XGPS will prevent common attacker steps while preserving expected functionality. This is important because almost all computing systems are susceptible to compromises. Existing approaches emphasize general protection hardware but leave gaps in defenses and cannot easily trace the program as it executes.The core challenge and idea is to describe, track, and ensure good behavior in the hardware itself.XGPS observes that almost all security policies are more precise when including a description of the program path. XGPS will develop a novel hardware mechanism for representing, tracing, and securing all program paths, including for the operating system. The first thrust will develop a general purpose data structure capable of representing the program path while remaining finite in size. The second thrust will implement the path in hardware while protecting it from supervisor level compromise. The third thrust will develop new efficient path based hardware/software security policies, demonstrating the efficacy of the path to enforce meaningful properties.The end result of this research will be the enhanced understanding and development of a system with rigorous control of program behavior. By controlling this behavior, XGPS will deny large classes of threats and, if adopted, will lead to a significantly stronger trusted computing base. Moreover, XGPS will enable existing hardware to tackle problems better suited to their capabilities. A core element of this research program will be engaging graduate and undergraduate students through courses, mentorship, and hands-on research activities. This project will actively pursue underrepresented minority students for research and security technology education.The outcome of this work will be high level models of core components, hardware based design and implementation, written reports, and experimental data. All artifacts will be kept at https://fiercelab.cs.rice.edu/projects/xgps/ and maintained for three years following the conclusion of the project.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.