Investigating software artifact provenance

调查软件工件的来源

• 批准号: 217236-2013
• 负责人: Godfrey, Michael
• 金额: $ 1.46万
• 依托单位: University of Waterloo
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2014
• 资助国家: 加拿大
• 起止时间: 2014-01-01 至 2015-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=546557
• 关键词: Investigating; software; artifact; provenance

"Provenance" is a term from the arts that describes a set of evidence concerning the history or ownership of an artistic work. The provenance for a particular object may include trusted documentation, special purpose analyses of the materials and artistic styles, and general historical knowledge. Increasingly, the term is also being used in technical contexts such as in computer security, where the provenance of a third-party component -- often determined through mechanisms such as cryptography and trusted audit trails -- may determine how the component is allowed to access confidential data and the system's run-time environment. However, as software systems become more pervasive, the risk of failure, malware, license violations, and patent lawsuits requires us to be circumspect about where various kinds of software entities come from. We must examine not only executable components, but all development artifacts that impact upon the software system and its creation. We must ask: Where did this class definition, library, feature, bug fix originate? How has it evolved over time? And what is the evidence? That is, we must ascertain the artifact's provenance.

“出处”是艺术界的一个术语，描述了一组关于艺术作品的历史或所有权的证据。一个特定对象的来源可能包括可信的文件，对材料和艺术风格的特殊目的分析，以及一般的历史知识。该术语也越来越多地用于计算机安全等技术上下文中，其中第三方组件的来源（通常通过加密和可信审计跟踪等机制确定）可能决定如何允许组件访问机密数据和系统运行时环境。然而，随着软件系统变得越来越普遍，故障、恶意软件、许可证违反和专利诉讼的风险要求我们对各种软件实体的来源保持谨慎。我们不仅要检查可执行组件，还要检查影响软件系统及其创建的所有开发工件。我们必须问：这个类定义、库、特性、bug修复是从哪里开始的？随着时间的推移，它是如何演变的？证据是什么？也就是说，我们必须确定藏物的来源。