SaTC: CORE: Small: Black-Box Flaw Discovery in Web Authentication and Authorization Mechanisms

现代智能手机的技术进步和移动互联网的广泛使用导致万维网成为日常生活中不可分割的一部分，渗透到专业、社交和个人活动中。所有这一切的核心在于识别(即，验证)用户和设备并允许(即，授权)他们访问帐户和敏感资源的能力。现有身份验证和授权机制中的缺陷允许网络罪犯以及民族国家攻击者获得非法访问权限，这可能会严重影响公民、公司和政府组织。该项目旨在通过对流行的和新兴的认证系统的分析，更好地保障万维网的安全。随后设计的防止恶意实体非法访问的强大机制将保护流行和关键的网络应用程序免受当前和不可预见的威胁。基础研究需要开发新的技术来分析Web应用程序，并主动演示新的攻击以指导更有效的身份验证机制的数据驱动设计。该项目试图研究的主要研究问题将成为本科生和研究生培养的基础。调查员致力于处理少数族裔和代表性不足的群体。现代网络应用程序的复杂性和安全机制的错综复杂往往会导致缺陷，使用户面临重大的安全和隐私威胁。网络生态系统的不断演变以及在未经安全界事先分析的情况下部署新的身份验证和授权机制，加剧了这种情况。该项目旨在探索现代网络生态系统中现有的和新兴的认证和授权系统和实践，并开发模块化的应用程序不可知和独立于协议的技术和框架，以沿着这些维度提升当前审计现代网络应用程序的能力。这包括开发使用差异测试技术的多个组件，每个组件旨在通过利用唯一的攻击载体来探索身份验证和授权的不同维度，从而在互联网范围内实现对缺陷的自动黑盒检测。这些技术和系统提供对当前网络身份验证环境的全面评估和处理，支持对未来威胁的预测和预防，并可以促进跨多个学科的研究。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Technical advancements in modern smartphones and the widespread availability of Internet on-the-go have resulted in the world wide web becoming an inextricable part of everyday lives, pervading professional, social and personal activities. At the core of all this lies the ability to identify (i.e., authenticate) users and devices and allowing (i.e., authorizing) them to access accounts and sensitive resources. Flaws in existing authentication and authorization mechanisms allow cybercriminals as well as nation-state adversaries to gain illegal access, which can critically affect citizens, corporations, and government organizations alike. This project aims to better secure the world wide web through the analysis of prevalent and emerging authentication systems. The subsequent design of robust mechanisms that prevent illicit access from malicious entities will secure popular and critical web applications against current and unforeseen threats. The underlying research necessitates the development of novel techniques for analyzing web applications, and the proactive demonstration of novel attacks for guiding a data-driven design of more effective authentication mechanisms. The main research problems that the project seeks to study will form the basis for the training of both undergraduate and graduate students. The investigator is committed to working with minorities and underrepresented groups.The complexity of modern web applications and the intricacies of security mechanisms often result in flaws that expose users to significant security and privacy threats. This is exacerbated by the continuous evolution of the web ecosystem and new authentication and authorization mechanisms being deployed without prior analysis by the security community. This project aims to explore existing and emerging authentication and authorization systems and practices in the modern web ecosystem, and develop modular application-agnostic and protocol-independent techniques and frameworks that advance current capabilities for auditing modern web applications along these dimensions. This includes the development of multiple components that employ differential testing techniques, each designed to explore a different dimension of authentication and authorization by leveraging a unique attack vector, thus, enabling the automated black-box detection of flaws at an Internet-wide scale. These techniques and systems provide a holistic evaluation and treatment of the current web authentication landscape, enable the forecasting and prevention of future threats, and can facilitate research across multiple disciplines.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.