TWC: Small: STRUCT: Enabling Secure and Trustworthy Compartments in Mobile Applications

TWC：小：STRUCT：在移动应用程序中启用安全且值得信赖的部分

• 批准号: 1800665
• 负责人: Long Lu
• 金额: $ 27.31万
• 依托单位: Northeastern University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-11-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1800665&HistoricalAwards=false
• 关键词: TWC; Small; STRUCT; Enabling; Secure

Society's dependence on mobile technologies rapidly increases as we entrust mobile applications with more and more private information and capabilities. Existing security research follows a common threat model that treats apps as monolithic entities and only captures attack surface between apps. However, recent research reveals that app internal attacks are emerging quickly as complex entities with conflicting interests are commonly included inside a single app to allow for rich features and fast development. This project, known as STRUCT, systematically investigates app compartmentalization as a novel and general approach to mitigating the critical yet unaddressed internal threats of apps. It applies this approach to major mobile platforms via solving four challenging and interesting research problems: (1) Deriving principles and models for designing intra-app security mechanisms; (2) Building compiler toolchains for automatically and securely compartmentalizing apps; (3) Building system-level enforcement mechanisms for open platforms; (4) Building app-level system-agnostic enforcement mechanisms for closed platforms. Solutions to these challenges together form a foundation to the design and implementation of intra-app security isolation and policy enforcement, which is currently nonexistent but in high demand. STRUCT has its broader impact in fostering a new direction in mobile security research and education as well as increasing society's adoption of mobile technology in security-sensitive scenarios.

随着我们将越来越多的私人信息和功能委托移动应用程序，社会对移动技术的依赖迅速增加。现有的安全研究遵循一个通用威胁模型，该模型将应用程序视为整体实体，仅捕获应用程序之间的攻击。但是，最近的研究表明，随着具有冲突利益冲突的复杂实体通常包含在单个应用程序中，以允许丰富的功能和快速开发。 该项目被称为结构，系统地研究了应用程序分隔是一种新颖而通用的方法，用于减轻应用程序的关键但未解决的内部威胁。它通过解决四个具有挑战性且有趣的研究问题将这种方法应用于主要的移动平台：（1）得出用于设计应用程序内安全机制的原理和模型； （2）用于自动，安全隔间化应用程序的构建编译器工具链； （3）开放平台的建筑系统级执法机制； （4）封闭平台的构建应用程序级的系统不可能的执法机制。 这些挑战的解决方案共同构成了APP内部安全隔离和政策执行的设计和实施的基础，目前不存在，但需求量很高。 Struct在促进移动安全研究和教育方面的新方向以及社会在对安全敏感的情况下采用移动技术方面具有更大的影响。