SaTC: TTP: Medium: Collaborative: Deployment-quality and Accessible Solutions for Cryptography Code Development

SaTC：TTP：中：协作：用于加密代码开发的部署质量和可访问解决方案

• 批准号: 1929701
• 负责人: Danfeng Yao
• 金额: $ 70万
• 依托单位: Virginia Polytechnic Institute and State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-10-01 至 2024-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1929701&HistoricalAwards=false
• 关键词: SaTC; TTP; Medium; Collaborative; Deployment

Vulnerabilities in cryptographic implementations seriously reduce the security guarantees of algorithms in practice and lead to attacks. An effective fix to the vulnerable code problem is automatic code checking. However, existing code verification tools cannot adequately cover cryptographic properties due to deficiencies in both accuracy, in terms of missed detection and false alarms, and scalability, in terms of complexity and runtime. The technology in this transition-to-practice project is to help secure cryptographic implementations, which are the foundation of many advanced systems. By making relevant research solutions deployment-grade, this effort can substantially improve the cryptographic coding practice and benefit software developers in all professions. The project's objective is to transition multiple secure cryptographic coding research solutions to practice and make it convenient and accessible to automatically screen programs against a wide range of cryptographic implementation vulnerabilities or misuses. The main technical enabler is a high precision and high throughput approach based on specialized program analysis techniques called CryptoGuard. CryptoGuard can detect a wide range of cryptographic misuses with ultra-low false alarm rates when used on complex and large-scale Java programs. The project leverages multiple popular software development and software security platforms, including the Software Assurance Marketplace, to make these tools effective in production environments. The systematic benchmark and measurement work is designed to advance the science of security and substantially raises the standard and quality of cryptographic code screening.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

密码实现中存在的漏洞严重降低了算法在实际应用中的安全性保证，导致攻击的发生。解决易受攻击的代码问题的一个有效方法是自动代码检查。然而，现有的代码验证工具不能充分地覆盖加密属性，这是由于在准确性（在漏检和误报警方面）和可扩展性（在复杂性和运行时间方面）两者上的缺陷。这个从过渡到实践的项目中的技术是帮助保护加密实现，这是许多高级系统的基础。通过使相关的研究解决方案部署级，这一努力可以大大改善加密编码实践，并使所有专业的软件开发人员受益。该项目的目标是将多个安全加密编码研究解决方案转化为实践，并使其方便和易于自动筛选程序，以防止各种加密实现漏洞或误用。主要的技术推动者是一种基于称为CryptoGuard的专业程序分析技术的高精度和高吞吐量方法。CryptoGuard可以检测各种各样的密码误用，当用于复杂和大规模的Java程序时，具有超低的误报率。该项目利用多个流行的软件开发和软件安全平台，包括软件保障市场，使这些工具在生产环境中有效。系统的基准和测量工作旨在推动安全科学的发展，并大大提高加密代码筛选的标准和质量。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

Tutorial: Investigating Advanced Exploits for System Security Assurance

• DOI: 10.1109/secdev51306.2021.00013
• 发表时间: 2021-10
• 期刊: 2021 IEEE Secure Development Conference (SecDev)
• 作者: Salman Ahmed;Long Cheng;Hans Liljestrand;N. Asokan;D. Yao

Poster: Comprehensive Comparisons of Embedding Approaches for Cryptographic API Completion

海报：加密 API 完成的嵌入方法的综合比较

• DOI: 10.1109/icse-companion55297.2022.9793808
• 发表时间: 2022
• 期刊: 2022 IEEE/ACM 44th International Conference on Software Engineering: Companion Proceedings (ICSE-Companion
• 作者: Xiao, Ya;Ahmed, Salman;Ge, Xinyang;Viswanath, Bimal;Meng, Na;Yao, Danfeng Daphne
• 通讯作者: Yao, Danfeng Daphne

Evaluation of Static Vulnerability Detection Tools With Java Cryptographic API Benchmarks

• DOI: 10.1109/tse.2022.3154717
• 发表时间: 2021-12
• 期刊: IEEE Transactions on Software Engineering
• 影响因子: 7.4
• 作者: Sharmin Afrose;Ya Xiao;Sazzadur Rahaman;B. Miller;D. Yao

Industrial Strength Static Detection for Cryptographic API Misuses

针对加密 API 滥用的工业强度静态检测

• DOI: 10.1109/secdev53368.2022.00022
• 发表时间: 2022
• 期刊: 2022 IEEE Secure Development Conference (SecDev
• 作者: Xiao, Ya;Zhao, Yang;Allen, Nicholas;Keynes, Nathan;Yao, Danfeng;Cifuentes, Cristina
• 通讯作者: Cifuentes, Cristina

A cost-effective, scalable, and portable IoT data infrastructure for indoor environment sensing

用于室内环境传感的经济高效、可扩展且便携式的物联网数据基础设施

• DOI: 10.1016/j.jobe.2022.104027
• 发表时间: 2022
• 期刊: Journal of Building Engineering
• 影响因子: 6.4
• 作者: Anik, Sheik Murad;Gao, Xinghua;Meng, Na;Agee, Philip R.;McCoy, Andrew P.
• 通讯作者: McCoy, Andrew P.