Strongbox: A System for Self-Securing Programs

Security is a pressing problem for distributed systems. Distributed systems exchange data among a variety of users over a variety of sites, which may be geographically separated. A user who stores important data on processor A must trust not just processor A but also the processors B C D . . . with which A communicates. The distributed security problem is difficult, and few major distributed systems attempt to address it. In fact, conventional approaches to computer security are so complex that they actually discourage designers from trying to build a secure distributed system: A software engineer who wishes to build a secure distributed data application finds that he or she must depend on the security of a distributed database which depends on the security of a distributed file system which depends on the security of a distributed operating system kernel, etc. Under this traditional design approach, security necessarily becomes a secondary concern since just making an (unsecure) distributed system work efficiently is a daunting task. And adding security raises the difficulty by an order of magnitude. We propose a new model of security: self-securing programs. Self-securing programs are designed to run in environments where only a minimal number of