TC: Small: Securing Web Software Systems

TC：小型：保护 Web 软件系统

• 批准号: 1018924
• 负责人: David Wagner
• 金额: $ 48万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-08-01 至 2015-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1018924&HistoricalAwards=false
• 关键词: TC; Small; Securing; Web; Software

The world-wide web has become one of computing's great success stories,changing the way that people around the world communicate, compute,and conduct their business. Unfortunately, security problems on the webare prevalent, and these problems increase costs for website operatorsand for Internet users. This project aims to develop new methods forsecuring the web, providing website developers and operators with newand improved tools to protect their site and their users.The research involves several technical directions. First, to helpprotect existing websites, this project will investigate ways of hardeninglegacy web application code to defend it against the most common attacks.Second, to provide a solid foundation for web systems of the future,this project will study how to provide robust protection for newlydeveloped code. The project will also study web development frameworksthat are safe by construction. Third, this project will develop toolsand techniques to incrementally migrate existing web applications tonext-generation safe-by-construction web frameworks. Fourth, this projectwill devise and carry out user studies to measure rigorously the effectof different programming languages, frameworks, and programming practicesupon the security of web applications. The broader impacts resulting fromthe proposed activity are potentially significant; if it is successful,this research could have a significant positive impact on the securityof web services and, in the longer term, on software security in general.

万维网已经成为计算领域最伟大的成功案例之一，它改变了世界各地人们交流、计算和开展业务的方式。 不幸的是，网络上的安全问题普遍存在，这些问题增加了网站运营商和互联网用户的成本。 本项目旨在开发新的网络安全方法，为网站开发者和运营商提供新的、改进的工具来保护他们的网站和用户。 首先，为了帮助保护现有网站，该项目将研究如何加固遗留的Web应用程序代码，以抵御最常见的攻击。其次，为了为未来的Web系统提供坚实的基础，该项目将研究如何为新开发的代码提供强大的保护。 该项目还将研究通过构造安全的Web开发框架。 第三，该项目将开发工具和技术，以逐步将现有的Web应用程序迁移到下一代安全构建Web框架。 第四，本项目设计并开展用户研究，以严格衡量不同编程语言、框架和编程实践对Web应用程序安全性的影响。 拟议活动产生的更广泛的影响可能是重要的;如果成功的话，这项研究可能会对网络服务的安全性产生重大的积极影响，从长远来看，对软件安全性产生重大的积极影响。