Security and Privacy of High Impact Computer Applications

本研究探讨了几个高影响、广泛使用的计算机应用程序和基于云的服务中的安全和隐私问题。使用任何对安全敏感的应用程序目前都需要信心的飞跃，因为用户没有简单的方法来验证计算机系统是否没有恶意软件，并且用户没有被网络钓鱼/欺骗攻击所愚弄。大多数安全工具都是为专家用户设计的，需要用户的勤奋，最多只能提供有限的保护，即使是针对常见的恶意软件威胁，更不用说高级的、国家支持的攻击了。另一方面，近年来，日常用户在互联网上的参与出现了惊人的增长，这主要是由营利性公司提供的“免费”网络服务推动的，这些公司期望企业可以通过不受限制地访问用户数据来赚钱。在这个过程中，用户的隐私，甚至是对隐私的期望，已经急剧丧失。Sun microsystems、b谷歌和Facebook的首席执行官们在不同的时间表示，“隐私已经死了”。从研究的角度来看，设计web服务的隐私保护技术是复杂的，因为需要平衡日常用户的安全性和易用性需求。

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users. The proposed research focuses on three goals: (a) leverage existing and newly introduced hardware security features to enhance the foundation of low-level system software layers to better support security-critical applications; (b) design privacy-preserving architectures and techniques given that users will continue exchanging data through cloud-based services; (c) deal with the "unmotivated user" problem by integrating security/privacy mechanisms with the functioning of the system itself. Overall, the proposed research addresses important privacy concerns of today's digital citizens, offers high-assurance techniques for businesses and government agencies, and helps increase trustworthiness of computing systems.