TC: Small: Securing Web Software Systems

TC：小型：保护 Web 软件系统

• 批准号: 1018924
• 负责人: David Wagner
• 金额: $ 48万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-08-01 至 2015-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1018924&HistoricalAwards=false
• 关键词: TC; Small; Securing; Web; Software

The world-wide web has become one of computing's great success stories,changing the way that people around the world communicate, compute,and conduct their business. Unfortunately, security problems on the webare prevalent, and these problems increase costs for website operatorsand for Internet users. This project aims to develop new methods forsecuring the web, providing website developers and operators with newand improved tools to protect their site and their users.The research involves several technical directions. First, to helpprotect existing websites, this project will investigate ways of hardeninglegacy web application code to defend it against the most common attacks.Second, to provide a solid foundation for web systems of the future,this project will study how to provide robust protection for newlydeveloped code. The project will also study web development frameworksthat are safe by construction. Third, this project will develop toolsand techniques to incrementally migrate existing web applications tonext-generation safe-by-construction web frameworks. Fourth, this projectwill devise and carry out user studies to measure rigorously the effectof different programming languages, frameworks, and programming practicesupon the security of web applications. The broader impacts resulting fromthe proposed activity are potentially significant; if it is successful,this research could have a significant positive impact on the securityof web services and, in the longer term, on software security in general.

万维网已成为计算领域最伟大的成功案例之一，改变了世界各地人们交流、计算和开展业务的方式。 不幸的是，网络上的安全问题普遍存在，这些问题增加了网站运营商和互联网用户的成本。 该项目旨在开发保护网络安全的新方法，为网站开发人员和运营商提供新的和改进的工具来保护其网站及其用户。该研究涉及多个技术方向。 首先，为了帮助保护现有网站，该项目将研究强化遗留 Web 应用程序代码的方法，以防御其抵御最常见的攻击。其次，为了为未来的 Web 系统提供坚实的基础，该项目将研究如何为新开发的代码提供强大的保护。 该项目还将研究构建安全的网络开发框架。 第三，该项目将开发工具和技术，以逐步将现有 Web 应用程序迁移到下一代安全构建 Web 框架。 第四，该项目将设计并开展用户研究，以严格衡量不同编程语言、框架和编程实践对 Web 应用程序安全性的影响。 拟议活动可能产生更广泛的影响；如果成功，这项研究可能会对网络服务的安全产生重大的积极影响，从长远来看，还会对整个软件安全产生重大的积极影响。