Ensuring Secure and Reliable Interactions between Mobile Applications and Cloud Services

确保移动应用程序和云服务之间安全可靠的交互

• 批准号: RGPIN-2022-03744
• 负责人: Wei, Lili
• 金额: $ 2.11万
• 依托单位: McGill University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=752310
• 关键词: Ensuring; Secure; Reliable; Interactions; between

Motivation Modern mobile apps are commonly integrated with cloud services to provide powerful computation capabilities. Mobile apps frequently exchange data with the cloud services. We name such exchanges as mobile-cloud interactions. It is challenging to build secure and reliable mobile-cloud interactions given the complicated runtime environment and the short release cycle of mobile apps. Software bugs in mobile-cloud interactions can significantly jeopardize the security and reliability of mobile apps. For example, it was reported that the misuse of cloud service credentials in mobile apps has induced massive user private data leaks. Studies were conducted to design secure communication protocols or detect malicious apps leaking user information. However, none of them studied issues in mobile-cloud interactions from the software engineering point of view. Objectives In my research career, I aim to improve the automation level for the QA practice to facilitate the identification of software bugs and reduce the QA costs. In the short term, I will focus on advancing software engineering practices for mobile applications (mobile apps) in the cloud computing era. Specifically, I aim to (1) characterize the diverse mobile-cloud interaction issues in practice, (2) develop effective techniques to identify security flaws in mobile-cloud interactions to protect the mobile apps and their users, and (3) propose novel test coverage criteria and test oracles that can effectively expose reliability issues in mobile-cloud interactions in an automatic manner. Team and Approach In this program, I plan to recruit two PhD students, two MEng (thesis-based) students and four BEng summer interns to achieve the short-term objectives. We will 1) construct and publish a large benchmark of mobile-cloud interaction issues, 2) leverage open coding method to analyze the benchmark and gain a comprehensive understanding on mobile-cloud interaction issues, 3) devise novel models to abstract mobile-cloud interactions and capture the concerned issues, and 4) leverage the models to design automated techniques to detection the issues. Outcome and Impact This program will generate the first public benchmark and empirical study of mobile-cloud interactions. We will also publish a set of techniques to automatically detect mobile-cloud interaction issues. The outputs can benefit both the research and the industrial communities. The study will break new ground for software engineering research on building reliable mobile cloud computing infrastructures. The techniques will increase the automation level in quality assurance process in mobile development companies in Canada, reducing their cost in developing and maintaining trustworthy mobile apps in the cloud computing era. The program will also train HQPs with technical and research skills that are highly demanded in Canada.

动机现代移动应用程序通常与云服务集成，以提供强大的计算能力。移动应用程序经常与云服务交换数据。我们将这种交换称为移动-云交互。考虑到移动应用程序复杂的运行环境和较短的发布周期，构建安全可靠的移动云交互是具有挑战性的。移动-云交互中的软件漏洞可能会严重危及移动应用的安全性和可靠性。例如，有报道称，移动应用程序中滥用云服务凭据导致了大量用户私人数据泄露。研究的目的是设计安全的通信协议或检测泄露用户信息的恶意应用程序。然而，他们都没有从软件工程的角度来研究移动-云交互中的问题。目的在我的研究生涯中，我的目标是提高QA实践的自动化水平，以便于识别软件缺陷，降低QA成本。在短期内，我将重点介绍云计算时代移动应用程序(移动应用程序)的先进软件工程实践。具体地说，我的目标是(1)描述实践中各种移动-云交互问题的特征，(2)开发有效的技术来识别移动-云交互中的安全缺陷，以保护移动应用及其用户，(3)提出新颖的测试覆盖标准和测试预言，能够有效地自动暴露移动-云交互中的可靠性问题。团队和方法在这个项目中，我计划招聘两名博士生，两名孟加拉(以论文为基础的)学生和四名BENG暑期实习生，以实现短期目标。我们将1)构建并发布移动-云交互问题的大型基准，2)利用开放编码方法分析基准并全面了解移动-云交互问题，3)设计新的模型来抽象移动-云交互并捕获关注的问题，4)利用模型设计自动化技术来检测问题。结果和影响该计划将产生首个移动-云交互的公共基准和实证研究。我们还将发布一套自动检测移动-云交互问题的技术。这些成果可以使研究和工业社区都受益。这项研究将为构建可靠的移动云计算基础设施的软件工程研究开辟新的天地。这些技术将提高加拿大移动开发公司质量保证流程的自动化水平，降低他们在云计算时代开发和维护值得信赖的移动应用程序的成本。该计划还将培训具有加拿大高度需求的技术和研究技能的HQP。