TC: Small: Securing Web Software Systems

TC：小型：保护 Web 软件系统

• 批准号: 1018924
• 负责人: David Wagner
• 金额: $ 48万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2010
• 资助国家: 美国
• 起止时间: 2010-08-01 至 2015-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1018924&HistoricalAwards=false
• 关键词: TC; Small; Securing; Web; Software

The world-wide web has become one of computing's great success stories,changing the way that people around the world communicate, compute,and conduct their business. Unfortunately, security problems on the webare prevalent, and these problems increase costs for website operatorsand for Internet users. This project aims to develop new methods forsecuring the web, providing website developers and operators with newand improved tools to protect their site and their users.The research involves several technical directions. First, to helpprotect existing websites, this project will investigate ways of hardeninglegacy web application code to defend it against the most common attacks.Second, to provide a solid foundation for web systems of the future,this project will study how to provide robust protection for newlydeveloped code. The project will also study web development frameworksthat are safe by construction. Third, this project will develop toolsand techniques to incrementally migrate existing web applications tonext-generation safe-by-construction web frameworks. Fourth, this projectwill devise and carry out user studies to measure rigorously the effectof different programming languages, frameworks, and programming practicesupon the security of web applications. The broader impacts resulting fromthe proposed activity are potentially significant; if it is successful,this research could have a significant positive impact on the securityof web services and, in the longer term, on software security in general.

世界范围的网络已经成为计算领域最伟大的成功故事之一，它改变了世界各地人们交流、计算和开展业务的方式。不幸的是，网络安全问题普遍存在，这些问题增加了网站运营商和互联网用户的成本。该项目旨在开发保护网络安全的新方法，为网站开发人员和运营商提供新的和改进的工具来保护他们的网站和用户。这项研究涉及几个技术方向。首先，为了帮助保护现有网站，这个项目将研究加固遗留web应用程序代码的方法，以抵御最常见的攻击。其次，为了为未来的web系统提供坚实的基础，该项目将研究如何为新开发的代码提供健壮的保护。该项目还将研究安全的网络开发框架。第三，该项目将开发工具和技术，以增量方式将现有web应用程序迁移到下一代构建安全web框架。第四，该项目将设计并开展用户研究，以严格衡量不同编程语言、框架和编程实践对web应用程序安全性的影响。拟议的活动所产生的更广泛影响可能是重大的；如果成功的话，这项研究将对web服务的安全性产生重大的积极影响，从长远来看，对软件的安全性也会产生普遍的影响。