Collaborative Research: SaTC: CORE: Small: Hyperproperty-based Enforcement of Information-flow Security

对于处理大量用户敏感信息的软件系统来说，执行保密或完整性等安全策略至关重要，在这些系统中，即使是短暂的短暂违反这些策略也可能导致高度敏感信息的泄露或损坏，危及安全，或者中断重要的公共或社会服务。安全策略的运行时监视和实施仍然是保护软件系统的基本技术之一。许多重要的安全策略，如信息流策略，不能表示为单个执行的属性，但可以表示为多个执行跟踪上的属性，这称为超属性。受一组丰富的真实世界应用程序的激励，该项目的总体目标是为超级属性开发有效的运行时强制执行技术，使系统能够针对各种类型的网络攻击和信息泄露提供强大的保护。该项目将在信息流属性的系统运行时强制执行方面带来范式转变，组织在三个研究推动力中，这些研究推动力将开发新的监视器设计、开放源码工具和执行严格的评估。第一个推动力将开发黑箱和灰箱预测监测器，以强制执行超级属性。这一推力还将调查不同的输入模型，特别是封闭系统，其中监视器可以操纵系统的输入，以强制执行超级属性和反应性系统，其中监视器不能干扰输入，因为它是由不可控环境产生的。第二个重点将集中在开发组合的运行时监视器上。该项目将设计一个组合的监视器基础设施，其中系统的各个部分由不同的监视器守卫，因为现代系统由来自相互不信任的来源的不同组件组成。第三个研究重点致力于通过深入研究研究人员的理论发现的应用来进行严格的评估。这项工作将应用前两个推力的结果来实现监视器，以在现实世界的应用程序中强制执行信息流属性和不可延展的信息流。与现有方法相比，这个项目的结果预计将具有几个优势：它们将更加通用，因为它们可以处理时态逻辑HyperLTL的丰富片段，并且将是可转移的、组成的和低管理费用的。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Enforcing security policies such as secrecy or integrity is crucial for software systems that handle large volumes of users’ sensitive information, where even a short transient violation of these policies may result in leaking or damaging highly sensitive information, compromising safety, or interruption of vital public or social services. Runtime monitoring and enforcement of security policies remains one of the foundational techniques for securing software systems. Many important security policies such as information-flow policies cannot be expressed as properties of individual executions, but can be expressed as properties on multiple execution traces, which are called hyperproperties. Motivated by a rich set of real-world applications, the overarching objective of this project is to develop effective runtime enforcement techniques for hyperproperties that enable strong protection of systems against various types of cyberattacks and information leaks. This project will bring about a paradigm shift in systematic runtime enforcement of information-flow properties, organized within three research thrusts that will develop novel monitor designs, open-source tools, and perform rigorous evaluation. The first thrust will develop black-box and grey-box predictive monitors for enforcing hyperproperties. This thrust will also investigate different input models, in particular, closed systems where the monitor can manipulate the input to the system to enforce a hyperproperty and reactive systems where the monitor cannot interfere with the input, as it is generated by an uncontrollable environment. The second thrust will focus on developing runtime monitors that are compositional. The project will design a composed monitor infrastructure where parts of the system are guarded by different monitors, as modern systems are composed of heterogeneous components from mutually distrusting sources. The third research thrust is dedicated to rigorous evaluation by delving into applications of the researchers' theoretical findings. This effort will apply results from the first two thrusts to implement monitors to enforce information flow properties and nonmalleable information flow on real world applications. The results of this project are expected to have several advantages as compared to the existing methods: they will be more general, as they can deal with a rich fragment of the temporal logic HyperLTL and will be transferable, compositional, and low-overhead.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.