The design and implementation of dynamic information flow tracking systems for software security
Abstract/Contents
- Abstract
- Computer security is in a crisis. Attackers are exploiting an ever-increasing range of software vulnerabilities in critical public and private sector computer systems for massive financial gain Recent research has established Dynamic Information Flow Tracking (DIFT) as a promising platform for detecting a wide range of security attacks. The idea behind DIFT is to tag (taint) untrusted data and track its propagation at byte or word-granularity through the system to prevent security attacks. This dissertation presents novel DIFT platforms and policies to address real-world server-side vulnerabilities, in both low-level and high-level code. We show that well-designed DIFT platforms and policies can comprehensively prevent the major server-side security vulnerabilities with little to no performance overhead and without requiring application source code access or debugging information. We describe novel DIFT policies for comprehensively preventing software vulnerabilities. We also present novel hardware and software DIFT platforms for executing these policies. We then demonstrate the effectiveness of our policies and platforms by preventing a wide range of real-world software vulnerabilities, from operating system buffer overflows in the Linux kernel to authentication bypass in PHP web applications. Unlike prior security techniques, DIFT can be fast, safe, practical, and flexible. We present Raksha, the first flexible hardware DIFT platform, which provides flexibility and safety while maintaining the practicality and performance benefits of traditional hardware DIFT designs. Raksha supports flexible, hardware-enforced DIFT policies using software-controlled tag policy registers. We demonstrate the Raksha design using an FPGA-based prototype system, and prevent a wide range of attacks on unmodified application binaries. We also use Raksha to develop a novel DIFT policy for robustly preventing buffer overflows. Our policy is the first comprehensive DIFT policy for buffer overflow prevention to support large, real-world applications and even the operating system without observed real-world false positives. We demonstrate our buffer overflow policy using the Raksha prototype, and prevent buffer overflows in both userspace applications and the Linux kernel. We also developed Nemesis, a DIFT-aware PHP interpreter, which was the first system for comprehensively preventing authentication and authorization bypass attacks in web applications. Nemesis uses a novel application of DIFT to automatically infer when a web application has correctly and safely authenticated a web client. We demonstrate the effectiveness of Nemesis by preventing authentication and authorization bypass vulnerabilities in real-world PHP web applications.
Description
| Type of resource | text |
|---|---|
| Form | electronic; electronic resource; remote |
| Extent | 1 online resource. |
| Copyright date | 2010 |
| Publication date | 2009, c2010; 2009 |
| Issuance | monographic |
| Language | English |
Creators/Contributors
| Associated with | Dalton, Michael |
|---|---|
| Associated with | Stanford University, Computer Science Department |
| Primary advisor | Kozyrakis, Christoforos, 1974- |
| Thesis advisor | Kozyrakis, Christoforos, 1974- |
| Thesis advisor | Lam, Monica S |
| Thesis advisor | Mazières, David (David Folkman), 1972- |
| Advisor | Lam, Monica S |
| Advisor | Mazières, David (David Folkman), 1972- |
Subjects
| Genre | Theses |
|---|
Bibliographic information
| Statement of responsibility | Michael Dalton. |
|---|---|
| Note | Submitted to the Department of Computer Science. |
| Thesis | Ph.D. Stanford University 2010 |
| Location | electronic resource |
Access conditions
- Copyright
- © 2010 by Michael Williams Dalton
- License
- This work is licensed under a Creative Commons Attribution Non Commercial 3.0 Unported license (CC BY-NC).
Also listed in
Loading usage metrics...