SQUIRE: Security Escorts for Untrusted Software

Period of Performance: 06/09/2006 - 06/09/2007

$98.9K

Phase 1 STTR

Recipient Firm

Global Infotek, Inc.
1920 Association Drive Suite 200
Reston, VA 20191
Principal Investigator
Firm POC

Research Institution

Massachusetts Institute of Technology
77 Massachusetts ave
Cambridge, MA 02139
Institution POC

Research Topics

Abstract

Global InfoTek, Inc. and MIT intend to produce a new computer security environment, SQUIRE, that mitigates the ubiquitous, unavoidable risk of using untrusted applications by strengthening the weakest link: the interaction between the human and complex, unintuitive security mechanisms. Usability of security is critical, since without it systems are frequently too hard to understand or too cumbersome to use, and in either case insecure. Since computer systems are dynamic, this interaction is not one-time, but recurs. Our focus on usability begins with a room metaphor similar to the coarse-grained security model we use in our homes. Security in SQUIRE is based on partitioning data and applications into rooms , so that every running instance of an application and every data file belong to exactly one room. SQUIRE will provide an interface simple enough for typical computer users to understand and convenient enough for them to actually use, using existing security technologies for enforcement. Our prior work with a similar system, Chameleon, provides us with starting points for both security model and user interface, both of which have been vetted with typical computer users. This springboard gives us a good head start in making SQUIRE a highly usable, and thus secure, system.