Pinpointing side-channel information leaks in web applications
Pinpointing side-channel information leaks in web applications
复制标题
精确定位 Web 应用程序中的侧通道信息泄漏
DOI：
10.1007/s13389-012-0036-0
复制
发表时间：
2012
影响因子：
1.9
通讯作者：
E. Oswald
中科院分区：
文献类型：
--
作者：
Luke Mather;E. Oswald
构建一个能够检测边信道观测序列中信息泄漏存在的测试是工程师试图设计系统抵御边信道攻击的重要研究目标。虽然侧信道攻击的传统目标是加密硬件设备，但最近的工作已经证明了软件的脆弱性，特别是Web应用程序。因此，已经有一个一致的驱动器朝着泄漏检测策略的发展，可以检查Web应用程序流量的信息泄漏的存在。在这项工作中，我们讨论了以前的方法的有效性，并描述了一种改进的，一般适用的测试的基础上的统计估计的用户输入到应用程序和随后的可观察到的侧信道信息之间的互信息。我们使用我们提出的指标来构建一个测试，能够分析数据包的采样痕迹的信息泄漏的存在，并展示了我们的测试在现实世界的Web应用程序的应用。
The construction of a test capable of detecting the presence of information leaks in a sequence of side-channel observations is an important research goal for engineers attempting to design systems resilient against side-channel attacks. Whilst the traditional targets of side-channel attacks are cryptographic hardware devices, recent works have demonstrated the vulnerability of software, and in particular web applications. As a result, there has been a concerted drive towards the development of a leakage detection strategy that can inspect web application traffic for the presence of information leaks. In this work we discuss the effectiveness of previous approaches, and describe an improved, generically applicable test based on a statistical estimation of the mutual information between the user inputs entered into the application and subsequent observable side-channel information. We use our proposed metric to construct a test capable of analysing sampled traces of packets for the presence of information leaks, and demonstrate the application of our test on a real-world web application.
影响因子：
1.2
作者：
Clark, David;Hunt, Sebastian;Malacaria, Pasquale
通讯作者：
Malacaria, Pasquale