一句话：提出机制无关的保密数据分析语言，以格标签、可表达安全策略和广义非干扰类型系统自动高效组合多种安全机制。
随着组织利用第三方云与边缘数据中心处理数据，机密性保护愈发重要。同态加密、Intel SGX、AMD SEV 等机制在安全属性、性能、可用性和应用方式上差异很大，程序员难以合理选择并正确使用。本文提出一种机制无关的分布式保密数据分析方法：以核心编程语言抽象各安全机制的细节；数据用沿格排列的自定义机密性级别标注；通过一种富有表达力的安全策略描述机制与标签之间的高层映射；并借助基于非干扰新形式化、经推广以支持该策略定义的 类型系统 来保证机密性。用基本安全无关子集编写的查询会被转换为完整语言，从而自动以高效、可能组合的方式使用机制，同时可证明地端到端保持数据查询的机密性。作者在 Apache Spark 上构建原型，展示了相比单一硬编码机制（包括现有系统）在通用性与性能上的显著优势，且不牺牲机密性。
As more organizations are leveraging third-party cloud and edge data centers to process data efficiently, the issue of preserving data confidentiality becomes increasingly important. In response, numerous security mechanisms have been introduced and promoted in recent years including software-based ones such as homomorphic encryption, as well as hardware-based ones such as Intel SGX and AMD SEV. However these mechanisms vary in their security properties, performance characteristics, availability, and application modalities, making it hard for programmers to judiciously choose and correctly employ the right one for a given data query.This paper presents a mechanism-independent approach to distributed confidentiality-preserving data analytics. Our approach hinges on a core programming language which abstracts the intricacies of individual security mechanisms. Data is labeled using custom confidentiality levels arranged along a lattice in order to capture its exact confidentiality constraints. High-level mappings between available mechanisms and these labels are captured through a novel expressive form of security policy. Confidentiality is guaranteed through a type system based on a novel formulation of noninterference, generalized to support our security policy definition. Queries written in a largely security-agnostic subset of our language are transformed to the full language to automatically use mechanisms in an efficient, possibly combined manner, while provably preserving confidentiality in data queries end-to-end. We prototype our approach as an extension to the popular Apache Spark analytics engine, demonstrating the significant versatility and performance benefits of our approach over single hardwired mechanisms --- including in existing systems --- without compromising on confidentiality.
@article{paperbot1934,
title = {Generalized Policy-Based Noninterference for Efficient Confidentiality-Preservation},
author = {Shamiek Mangipudi and Pavel Chuprikov and Patrick Eugster and Malte Viering and Savvas Savvides},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {PLDI},
year = {2023},
doi = {10.1145/3591231}
}