Vulnerability Assessment of Grid Software Infrastructure

美国国家科学基金会网络基础设施软件开发（SDCI）项目网络基础设施办公室提案编号：0844219首席研究员：Barton miller机构：威斯康星大学麦迪逊分校提案标题：网格软件基础设施项目脆弱性评估摘要本探索性研究（SGER）小额赠款提案旨在识别网格环境软件中的安全漏洞。拟议的活动包括脆弱性识别和分析方面的一系列研究和发展。一项名为“基于脆弱性评估的第一原则”（FPVA）的新流程将被推行，其中包括一个4级量表，以识别高价值资产并根据其使用情况得出威胁。这些活动承诺产生算法、技术和工具，供软件开发人员和网格社区用于识别软件漏洞。评估将对目前在网格环境中积极使用的两个安全系统进行。最后，这项工作旨在帮助在软件漏洞评估和更安全的编码实践方面形成一个更复杂和更长期的研究和开发工作的基础。该建议的智力价值在于它对软件漏洞评估的基本方法的潜在贡献，包括新过程、新算法、新工具和漏洞的正式表征。更广泛的影响体现在工作中？在支持整个NSF社区的环境中，网格软件有可能显著提高安全性和可靠性。

National Science FoundationNSF Software Development for Cyberinfrastructure (SDCI) ProgramOffice of CyberinfrastructureProposal Number: 0844219Principal Investigator: Barton MillerInstitution: University of Wisconsin-MadisonProposal Title: Vulnerability Assessment of Grid Software Infrastructure Project SummaryThis Small Grants for Exploratory Research (SGER) proposal seeks to identify security vulnerabilities in software for Grid environments. Proposed activities cover a range of research and development in vulnerability identification and analysis. A new process called First Principles based on Vulnerability Assessment (FPVA) will be pursued that includes a 4-level scale to identify high-value assets and deriving threats based on their use. The activities promise to produce algorithms, techniques, and tools used by software developers and the grid community in identifying software vulnerabilities. Assessment will be performed on two security systems used actively in grid environments today. Finally, the work intends to help form the basis of a more involved and longer term research and development effort in software vulnerability assessment and safer coding practices. Intellectual merit of the proposal lies in its potential contributions to fundamental approaches to software vulnerability assessment, including a new process, new algorithms, new tools, and formal characterizations of vulnerabilities. Broader impact is characterized in the work?s potential to significantly improve security and reliability of grid software used in environments supporting the entire NSF community.