SHF: Small: Collaborative Research: Beyond Secure Processors - Securing Systems Against Hardware

SHF：小型：协作研究：超越安全处理器 - 保护系统免受硬件攻击

• 批准号: 0915501
• 负责人: Yan Solihin
• 金额: $ 23.02万
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-15 至 2014-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0915501&HistoricalAwards=false
• 关键词: SHF; Small; Collaborative; Research; Beyond

Computer systems are increasingly located in places, where they can be physically accessed by people who are not authorized to have unrestricted control of and access to these systems. Examples of this include company laptops carried by employees, robotic vehicles, gaming consoles with copyright protection mechanisms, and remote users of servers in data-centers. An emerging threat in such scenarios are hardware attacks, where snooping devices are attached to the system to directly read and/or modify data within the system. These attacks can circumvent all traditional security protections in the system, such as password checks, access permissions for data files, etc.To address these threats, researchers and processor makers have proposed or developed various types of secure processor architectures, which encrypt and continuously verify data in the system?s memory. However, these secure processors are far from being ready for widespread use, primarily because they focus on a single-processor, non-mobile system that is already up and running and executing a single application. This research project will investigate how to overcome these limitations, focusing on mechanisms for secure boot-up and system configuration, secure communication between and migration of applications, secure access to peripheral devices (including the network). In essence, this project will build the intellectual framework that will be needed to make computers secure regardless of their physical location, preventing unauthorized access even if the system is captured, stolen, or actually owned by a potentially malicious entity. Other broader impacts of this project include improvements in education and workforce, by making computer hardware designers more aware of physical security and by making computer security experts more aware of implications of physical (hardware) attacks.

计算机系统越来越位于地点，在那里他们可以被无授权对这些系统的无限制控制和访问的人进行物理访问。其中的例子包括员工携带的公司笔记本电脑，机器人车，具有版权保护机制的游戏机以及数据中心服务器的远程用户。在这种情况下，新兴的威胁是硬件攻击，在系统中附加了窥探设备，以直接读取和/或修改系统中的数据。这些攻击可以规避系统中的所有传统安全保护措施，例如密码检查，数据文件的访问权限等。要解决这些威胁，研究人员和处理器制造商已经提出或开发了各种类型的安全处理器架构，这些安全处理器体系结构对系统内存中的数据进行了加密并连续验证数据。但是，这些安全的处理器尚未准备好广泛使用，主要是因为它们专注于已经启动并运行和执行单个应用程序的单处理器的非移动系统。该研究项目将调查如何克服这些限制，重点关注安全启动和系统配置的机制，安全性之间的安全通信以及应用程序的迁移，安全访问外围设备（包括网络）。从本质上讲，该项目将建立一个智力框架，无论其物理位置如何，都将需要使计算机安全，即使系统被捕获，被盗或实际由潜在的恶意实体捕获，也可以防止未经授权的访问。该项目的其他更广泛的影响包括改善教育和劳动力，通过使计算机硬件设计人员更加了解物理安全，并使计算机安全专家更加了解物理（硬件）攻击的影响。