CT-T: Collaborative Research: Complex, High-level, Integrated Properties for Security

CT-T：协作研究：复杂、高级、集成的安全属性

• 批准号: 0716715
• 负责人: David Wagner
• 金额: $ 5万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-10-01 至 2008-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0716715&HistoricalAwards=false
• 关键词: CT; Collaborative; Research; Complex; level

The last ten years have seen substantial progress in our ability to automatically analyze source code for security properties. These advances are transitioning into practice and making a broad impact on software security. However, the success of this work has been partially limited by the fact that there are many security properties that we do not know how to analyze.This project seeks to take several initial steps towards extending the range and scope of security properties that can be checked on large software systems. The research involves three tracks. First, we will investigate how the design of programming languages can support secure programming practices. Second, we will study techniques for analyzing memory safety, a a complex yet fundamental security property that, surprisingly, is still not statically checkable today. Third, we will study how to check that networking software is consistent with the specifications implied in standards committees' descriptions of network protocols. Integrated together, these three directions will allow us to provide end-to-end guarantees of security properties that span from low to high level. The goal of this project is to begin the work of developing a future generation of techniques for improving software security.

在过去的十年里，我们在自动分析安全属性的源代码方面取得了实质性的进步。这些进步正在转化为实践，并对软件安全产生广泛影响。然而，这项工作的成功在一定程度上受到这样一个事实的限制，即有许多我们不知道如何分析的安全属性。该项目寻求采取几个初步步骤来扩大可以在大型软件系统上检查的安全属性的范围和范围。这项研究涉及三个方面。首先，我们将调查编程语言的设计如何支持安全编程实践。其次，我们将研究分析内存安全的技术，这是一个复杂但基本的安全属性，令人惊讶的是，今天仍然不能静态检查。第三，我们将研究如何检查网络软件是否与标准委员会的网络协议描述中隐含的规范一致。这三个方向结合在一起，将使我们能够为从低到高级别的安全属性提供端到端的保证。该项目的目标是开始开发用于提高软件安全性的下一代技术。