Ensuring Secure and Reliable Interactions between Mobile Applications and Cloud Services

动机现代移动的应用程序通常与云服务集成，以提供强大的计算能力。移动的应用程序经常与云服务交换数据。我们将这种交流称为移动云交互。鉴于复杂的运行时环境和移动的应用程序的短发布周期，构建安全可靠的移动云交互具有挑战性。移动-云交互中的软件错误可能会严重危及移动的应用程序的安全性和可靠性。例如，据报道，在移动的应用程序中滥用云服务凭据已导致大量用户隐私数据泄露。研究旨在设计安全的通信协议或检测泄露用户信息的恶意应用程序。然而，他们都没有从软件工程的角度研究移动云交互的问题。目的在我的研究生涯中，我的目标是提高QA实践的自动化水平，以促进软件缺陷的识别和降低QA成本。在短期内，我将专注于推进云计算时代移动的应用程序（移动的应用程序）的软件工程实践。具体来说，我的目标是（1）在实践中描述各种移动云交互问题，（2）开发有效的技术来识别移动云交互中的安全缺陷，以保护移动的应用程序及其用户，以及（3）提出新的测试覆盖标准和测试预言机，可以有效地自动暴露移动云交互中的可靠性问题。团队和方法在这个项目中，我计划招收两名博士生，两名工程硕士（论文型）学生和四名工程学士暑期实习生，以实现短期目标。我们将1）构建并发布一个大型的移动云交互问题基准，2）利用开放编码方法分析基准并全面了解移动云交互问题，3）设计新的模型来抽象移动云交互并捕获相关问题，以及4）利用模型设计自动化技术来检测问题。成果和影响该计划将产生第一个公共基准和移动云交互的实证研究。我们还将发布一组自动检测移动云交互问题的技术。这些成果可以使研究界和工业界受益。这项研究将为构建可靠的移动的云计算基础设施的软件工程研究开辟新天地。这些技术将提高加拿大移动的开发公司质量保证过程的自动化水平，降低他们在云计算时代开发和维护值得信赖的移动的应用程序的成本。该计划还将培训具有加拿大高度需求的技术和研究技能的HQP。

Motivation Modern mobile apps are commonly integrated with cloud services to provide powerful computation capabilities. Mobile apps frequently exchange data with the cloud services. We name such exchanges as mobile-cloud interactions. It is challenging to build secure and reliable mobile-cloud interactions given the complicated runtime environment and the short release cycle of mobile apps. Software bugs in mobile-cloud interactions can significantly jeopardize the security and reliability of mobile apps. For example, it was reported that the misuse of cloud service credentials in mobile apps has induced massive user private data leaks. Studies were conducted to design secure communication protocols or detect malicious apps leaking user information. However, none of them studied issues in mobile-cloud interactions from the software engineering point of view. Objectives In my research career, I aim to improve the automation level for the QA practice to facilitate the identification of software bugs and reduce the QA costs. In the short term, I will focus on advancing software engineering practices for mobile applications (mobile apps) in the cloud computing era. Specifically, I aim to (1) characterize the diverse mobile-cloud interaction issues in practice, (2) develop effective techniques to identify security flaws in mobile-cloud interactions to protect the mobile apps and their users, and (3) propose novel test coverage criteria and test oracles that can effectively expose reliability issues in mobile-cloud interactions in an automatic manner. Team and Approach In this program, I plan to recruit two PhD students, two MEng (thesis-based) students and four BEng summer interns to achieve the short-term objectives. We will 1) construct and publish a large benchmark of mobile-cloud interaction issues, 2) leverage open coding method to analyze the benchmark and gain a comprehensive understanding on mobile-cloud interaction issues, 3) devise novel models to abstract mobile-cloud interactions and capture the concerned issues, and 4) leverage the models to design automated techniques to detection the issues. Outcome and Impact This program will generate the first public benchmark and empirical study of mobile-cloud interactions. We will also publish a set of techniques to automatically detect mobile-cloud interaction issues. The outputs can benefit both the research and the industrial communities. The study will break new ground for software engineering research on building reliable mobile cloud computing infrastructures. The techniques will increase the automation level in quality assurance process in mobile development companies in Canada, reducing their cost in developing and maintaining trustworthy mobile apps in the cloud computing era. The program will also train HQPs with technical and research skills that are highly demanded in Canada.