TWC: Small: Quantitative Analysis and Reporting of Electromagnetic Covert and Side Channel Vulnerabilities

大多数传统的计算机安全方法假定来自系统的信息只能通过预期的输出通道发送，例如网络连接、监视器、便携式磁盘驱动器等。旁通道和隐蔽通道攻击通过提取通过非预期的信号从系统泄露或故意发送的信息来绕过这些保护。用于减少这种信息泄漏的方法通常与特定的硬件和/或特定的算法捆绑在一起，并且非常耗费人力。这允许特定的代码片段(如加密函数)相对安全，但对于也倾向于处理敏感信息的大型代码(如整个操作系统或Web浏览器)中的分析和保护是不可行的。该项目正在调查软件活动和由此导致的侧通道泄漏之间的关系，目标是自动化软件分析，以发现哪些数据可能被泄露，哪些代码部分可能被泄露。这些分析可以揭示软件中的隐蔽通道(有意)和旁通道(无意)泄漏漏洞，帮助程序员集中精力减少或消除这些漏洞。除了有助于加强国家安全的这些研究内容外，该项目还包括具体的外联活动，例如建立一个互动演示器，帮助教育公众了解网络安全概念，以及访问当地学校，以帮助改善K-12教育以及妇女和少数民族在科学和工程领域的参与。

Most traditional approaches to computer security assume that information from the system can only be sent through intended output channels, such as network connection, monitor, portable disk drive, etc. Side-channel and covert-channel attacks circumvent these protections by extracting information that is leaked or deliberately sent from the system through unintended signals, such as electromagnetic emanations, power consumption, timing of computational activity, etc. Methods for reducing such information leakage are usually tied to specific hardware and/or specific algorithms, and are very labor intensive. This allows specific fragments of code, such as cryptographic functions, to be relatively safe, but is not feasible for analysis and protection in large codes, such as entire operating systems or web browsers, that also tend to process sensitive information. This project is investigating the relationship between software activity and the resulting side-channel leakage, with the goal of automating software analyses that can discover which data might be leaked and in which parts of the code. These analyses can reveal both covert-channel (intentional) and side-channel (unintentional) leakage vulnerabilities in software, helping programmers focus their efforts on reducing or eliminating these vulnerabilities. In addition to these research components that will help increase national security, the project also includes specific outreach activities, such as building an interactive demonstrator to help educate the public about cyber-security concepts, and visits to local schools to help improve K-12 education and participation of women and minorities in science and engineering.