TWC: Small: Quantitative Analysis and Reporting of Electromagnetic Covert and Side Channel Vulnerabilities

大多数传统的计算机安全方法假设来自系统的信息只能通过预期的输出通道发送，例如网络连接，监视器，便携式磁盘驱动器等。侧通道和隐蔽通道攻击通过提取通过非预期信号从系统泄漏或故意发送的信息来规避这些保护，例如电磁辐射，功耗，计算活动的时间，用于减少这种信息泄漏的方法通常与特定硬件和/或特定算法相关联，并且是非常劳动密集的。这使得特定的代码片段（如加密函数）相对安全，但对于大型代码（如整个操作系统或Web浏览器）的分析和保护是不可行的，因为它们也倾向于处理敏感信息。该项目正在调查软件活动与所导致的侧通道泄漏之间的关系，目标是自动化软件分析，从而发现哪些数据可能泄漏以及代码的哪些部分。这些分析可以揭示软件中的隐蔽通道（有意）和侧通道（无意）泄漏漏洞，帮助程序员集中精力减少或消除这些漏洞。除了这些有助于加强国家安全的研究内容外，该项目还包括具体的外联活动，例如建立一个互动演示器，以帮助教育公众网络安全概念，并访问当地学校，以帮助改善K-12教育以及妇女和少数民族参与科学和工程。

Most traditional approaches to computer security assume that information from the system can only be sent through intended output channels, such as network connection, monitor, portable disk drive, etc. Side-channel and covert-channel attacks circumvent these protections by extracting information that is leaked or deliberately sent from the system through unintended signals, such as electromagnetic emanations, power consumption, timing of computational activity, etc. Methods for reducing such information leakage are usually tied to specific hardware and/or specific algorithms, and are very labor intensive. This allows specific fragments of code, such as cryptographic functions, to be relatively safe, but is not feasible for analysis and protection in large codes, such as entire operating systems or web browsers, that also tend to process sensitive information. This project is investigating the relationship between software activity and the resulting side-channel leakage, with the goal of automating software analyses that can discover which data might be leaked and in which parts of the code. These analyses can reveal both covert-channel (intentional) and side-channel (unintentional) leakage vulnerabilities in software, helping programmers focus their efforts on reducing or eliminating these vulnerabilities. In addition to these research components that will help increase national security, the project also includes specific outreach activities, such as building an interactive demonstrator to help educate the public about cyber-security concepts, and visits to local schools to help improve K-12 education and participation of women and minorities in science and engineering.