TC: Small: Reining in Side-Channel Information Leaks in the Software-as-a-Service Era

随着软件即服务(SaaS)迅速成为主流，Web应用程序越来越多地取代桌面软件。Web应用程序是一个由两部分组成的程序，其组件部署在浏览器和Web服务器中。这两个组件之间的交互不可避免地向通信流的任何观察者揭示程序的内部状态，只需通过分组长度的模式和交互的定时，即使流是完全加密的。这项研究表明，这些“旁路”信息泄露既基本又常见：许多流行的网络应用程序被发现会泄露高度敏感的用户数据，如家庭收入、健康状况、投资等。这项研究将深入了解Web应用程序的侧通道漏洞，特别是导致侧通道泄漏的设计特征和领域知识。基于这一理解，开发了新的技术，以促进在Web应用程序的开发和操作期间检测和缓解旁路威胁。这些技术将向用户提供，以便他们可以评估自己的漏洞，并向开发人员提供，以便他们可以减少他们构建的应用程序中的漏洞。该项目的成果将有助于改进SaaS基础设施和云计算中的隐私保护。

With software-as-a-service (SaaS) rapidly becoming mainstream, web applications increasingly substitute for desktop software. A web application is a two-part program, with its components deployed both in the browser and in the web server. The interactions between these two components inevitably reveal the program's internal states to any observer of the communication stream, simply through the pattern of packet lengths and the timing of interactions, even if stream is entirely encrypted. This research reveals that these "side-channel" information leaks are both fundamental and common: a number of popular web applications are found to disclose highly sensitive user data such as one's family income, health profile, investments and more. This research will develop an in-depth understanding of web applications' side channel vulnerabilities, particularly the design features and domain knowledge that lead to side-channel leaks. Based upon this understanding, new technologies are developed to facilitate the detection and mitigation of the side-channel threats during the development and operation of web applications. These technologies will be made available to users so they can assess their vulnerabilities and to developers so they can reduce the vulnerabilities in the applications they build. The outcomes of the project will contribute to the improvement of privacy protection in the SaaS infrastructure and cloud computing.