TC: Small: Practical Data Confinement

International Computer Science Institute, Berkeley CA

Investigators

Abstract

In today's information-driven economy, organizations are finding it increasingly difficult to control the flow of sensitive information. This project is building a system called PDC (for Practical Data Confinement), a novel information security architecture built around coarse-grained isolation, fine-grained dynamic information flow tracking (DIFT), and informed policy enforcement. In broad terms, PDC provides mechanisms for tracking the movement of confidential data and enforcing dissemination restrictions that specify how, when, and to whom the data may be externalized. PDC requires no changes to applications or the operating system, and is thus readily deployable in existing IT environments. PDC makes use of an augmented hypervisor that enforces inter-VM isolation and carefully tracks the movement of sensitive data between the virtual CPU registers, memory, and disk within each VM. The hypervisor also intercepts all externally observable output actions (e.g., network communication, writing data to a mobile storage medium, sending data to a printer) and enforces security policies, allowing or denying specific application requests to externalize sensitive data. The main focus of the current work is to overcome the performance barriers that have hindered similar approaches in the past.