SGER: Enabling Electronic Self-Defense with Dynamic Identities

SGER：通过动态身份实现电子自卫

基本信息

批准号：
0549087
负责人：
Douglas Thain
金额：
$ 9.95万
依托单位：
University of Notre Dame
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2005
资助国家：
美国
起止时间：
2005-09-01 至 2007-08-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=0549087&HistoricalAwards=false
关键词：
SGER Enabling Electronic Self Defense

项目摘要

NSF 0549087SGER: Enabling Electronic Self-Defense with Dynamic IdentitiesPI: Douglas Thain In many operating systems, only a highly privileged user (a "super user") is allowed to create new users. This limitation prevents ordinary users from protecting themselves from untrustworthy applications, because it is difficult for a user to create a new, more restricted environment in which to run questionable applications. It also presents software designers with an uncomfortable choice: they may either run as an ordinary user and put themselves at risk, or they may run as the super-user and put the entire system at risk. This problem has afflicted the technical community for decades and now affects the public on the web and in grid computing. The concept of dynamic identities attacks this problem. In an operating system with dynamic identities, any user may create sub-identities at runtime without interacting with an administrator. Single users may perform self-defense by using dynamic identities to run untrusted programs. Dynamic identities also simplify the administration of distributed systems: accounts may be created on the fly according to local or global admission policies. This research will evaluate this concept by implementing it and using the implementation to explore the tradeoffs within an existing open source operating system. Preliminary work will investigate interactions between applications and the operating system. The results of this work will be experience reports describing and evaluating the implementation, applications, and deployment of dynamic identitie

NSF 0549087SGER：通过动态身份实现电子自卫PI：Douglas Thain 在许多操作系统中，只有高度特权的用户（“超级用户”）才被允许创建新用户。此限制阻止普通用户保护自己免受不可信应用程序的侵害，因为用户很难创建一个新的、更受限制的环境来运行可疑的应用程序。它还给软件设计人员带来了一个令人不安的选择：他们要么以普通用户身份运行并使自己面临风险，要么以超级用户身份运行并使整个系统面临风险。这个问题几十年来一直困扰着技术界，现在也影响着网络和网格计算领域的公众。动态身份的概念解决了这个问题。在具有动态身份的操作系统中，任何用户都可以在运行时创建子身份，而无需与管理员交互。单个用户可以通过使用动态身份运行不受信任的程序来进行自卫。动态身份还简化了分布式系统的管理：可以根据本地或全局准入策略动态创建帐户。本研究将通过实施这一概念并使用该实施来探索现有开源操作系统内的权衡来评估这一概念。初步工作将研究应用程序和操作系统之间的交互。这项工作的结果将是描述和评估动态身份的实施、应用和部署的经验报告