In this project, we developed methods that programmers can use to retrofit their programs with security controls for containment, authorization, and auditing to satisfy explicit security goals.  This project has included major activities on automating key tasks in retrofitting programs via privilege separation for containment, retrofitting programs with authorization hook placements to enforce desired policies, retrofitting programs automatically with auditing code, and retrofitting programs to enforce finer-grained control-flow integrity policies.  Through this research, we have also explored methods to unify defenses to improve overall security, developed open-source mechanisms to enforce security that have been widely used, and discovered and fixed flaws in commercial systems.  Many of our results have been published in top conferences in computer security and related domains.

The main objectives met during the project include the following. First, we developed new methods to automate key challenges in privilege separating programs to enable confinement, by handling general pointers (PtrSplit, ACM CCS 2017) and by balancing performance and security (PrograMander, ACM CCS 2019).  Second, we developed new methods to automate retrofitting of programs with authorization hooks to minimize a hook placement necessary to enforce any access control policy that satisfied prescribed constraints (ESSoS 2015) and to provide a security namespace abstraction for Linux container systems (USENIX Security 2018).  Third, we developed foundational theories for auditing based on information algebra, which combines elements of both access control and auditing to enable a uniform method to express break-the-glass policies (POST 2016), and developed new methods to retrofit programs for authorization by leveraging dynamic taint analysis (PLAS 2016).  Fourth, we invented a technique to compute control-flow integrity policies statically that is finer-grained than prior techniques and could be implemented more efficiently (IEEE Euro S&P 2016) and adapted a recent Intel PT hardware feature to enforce control-flow integrity without program modification (ASPLOS 2017).  In the course of this CFI work, we discovered a latent flaw in Linux compiler toolchains that allows extensive modification of various types of read-only data and proposed detailed countermeasures (NDSS 2017).

The key outcomes of this project include the novel techniques (described above), new open-source systems, repairs and extensions for the Linux kernel, and several student theses.  The methods for privilege separation and Linux kernel support for efficient use of the Intel PT hardware (Linux Griffin) feature have been open sourced.  The privilege separation work has led to two collaborations, one on the DARPA GAPS program, and the Linux Griffin kernel has been used by several research groups.  Through our efforts, the Linux compiler toolchain flaw we discovered has been fixed in both GCC and LLVM toolchains, and the Linux security namespace is under consideration for upstreaming into the mainline kernel.  This project has resulted in five theses, include three Ph.D. theses (one to be held in January 2020) and two M.S. theses.  The project was inspired by the Ph.D. thesis of a female student, and one of the M.S. theses was completed by a female student.  The materials developed in this project were applied to the creation of a new Software Security course at Penn State, which is a key component of the new Cybersecurity Foundations minor.

Last Modified: 11/26/2019
Modified by: Trent Jaeger