Foundations of Secure Web Programming

我们生活中的许多重要活动都与网络有关。我们在Facebook上社交，在YouTube上娱乐，网上银行，把工作存到云端，在LinkedIn上找工作，我们中的一些人甚至在第二人生上结婚。网络技术之所以如此令人兴奋，是因为人们和公司一直在寻找新的、有创意的方法，把它用于设计者没有预见到的应用：例如，用网络打电话，用手机浏览网页。不幸的是，正是由于这个原因，web应用程序所基于的软件和协议在设计时并没有考虑到适当的安全级别。我们与web应用程序共享的一些信息非常有价值，应该小心保护。新闻报道经常提醒我们网络犯罪是如何对我们的财务、隐私和幸福产生负面影响的。网络公司是强烈的创新驱动型企业，专注于尽可能快地交付新的应用程序和功能，并根据受欢迎程度或盈利能力选择保留哪些应用程序和功能。虽然安全的重要性得到了承认，但最常见的方法是通过监视系统并在检测到安全违规时进行干预来加强安全性。随着这个行业的成熟，人们越来越意识到必须将安全性构建到用于编程web应用程序的语言和工具中，并且越来越需要获得一定程度的信心，以确保应用程序是有效安全的。在我迄今为止的职业生涯中，我深入学习了理解计算机程序的基础和原理，并确保它们在没有安全漏洞的情况下正确工作。在接下来的几年里，我将面临应用这些原则为web编程奠定坚实的正式基础的挑战。我想深入了解网络上使用的当前和新兴技术，找到使它们更安全的方法，并为未来的网络技术和工具的设计做出贡献。这个过程将涉及大量的创造性思维，并导致创新的科学成果，因为一个安全的web应用程序必须结合安全的重要组件，如数据库、互联网协议、脚本语言和web浏览器。下面是我的建议的第一步的例子。Facebook用户用JavaScript（一种位于网页内部并使其具有交互性的语言）编写Facebook应用程序，并与其他用户共享。这就提出了限制这种由潜在恶意用户编写的JavaScript的问题，以确保它对所有其他Facebook用户是安全的。与斯坦福大学的同事一起，我将JavaScript建模为一组具有非常精确含义的简单数学公式，一旦我理解了这种语言及其安全属性（通过证明几个数学结果），我就研究了Facebook限制JavaScript的方式，并发现了几个缺陷。恶意用户可能编写了不良的Facebook应用程序，能够窃取信息并破坏其他用户的个人资料或网络浏览器。我联系了Facebook团队，讨论了可能的解决方案，他们相应地修改了他们的限制机制。这只是一个例子，说明我所提出的工作是如何包含在原创性的基础研究中，同时也对数百万人的生活产生直接影响。按照类似的方法，我还将对用于编程web服务器的语言（如PHP）和浏览器及其DOM库进行建模，并研究它们的安全属性。我将参与与web安全相关的标准的定义，并影响几个主要web应用程序的设计，如iGoogle门户网站的未来版本，Yahoo！微软的广告平台和微软用于mashup的Web Sandbox框架。我已经见过这些公司的研究人员，他们都对这方面的研究感兴趣。

Many important activities in our lives involve the web. We socialize on Facebook, have fun on YouTube, bank online, store our work in the cloud, find a job on LinkedIn and some of us even get married on Second Life. What makes web technology so exciting is that people and companies keep finding new and creative ways of using it for applications not foreseen by its designers: for example, using the web to make phone calls and mobile phones to browse the web.Unfortunately, for this very reason, the software and protocols on which web applications are based are not designed with the appropriate level of security in mind. Some of the information we share with web applications is very valuable, and should be protected carefully. News stories often remind us how cyber-crime negatively affects our finances, privacy and well-being.Web companies are strongly innovation-driven and focus on delivering new applications and features as quickly as possible, selecting which ones to maintain based on popularity or profitability. While the importance of security is acknowledged, the most common approach is to enforce security by monitoring the system and intervening when a security violation is detected. As this industry matures, there is a raising awareness that security must to be built into the languages and tools used to program web applications, and there is a growing need to gain some level of confidence that an application is effectively secure.In my career so far, I have studied in depth the foundations and principles for understanding computer programs and making sure that they work correctly without security breaches. Over the next few years, I will face the challenge of applying these principles to lay web programming on a sound formal ground. I want to understand deeply the current and emerging technologies that are used on the web, find ways to make them more secure, and contribute to the design of future web technologies and tools. This process will involve lots of creative thinking, and lead to innovative scientific results, because a secure web application must combine securely non-trivial components such as databases, internet protocols, scripting languages and web browsers.Here is an example of a first step in the direction of my proposal. Facebook users write Facebook applications in JavaScript (the language that sits inside web pages and makes them interactive) and share them with other users. This raises the problem of restricting such JavaScript, written by a potentially malicious user, to make sure that it is safe for all the other Facebook users. With colleagues in Stanford, I modelled JavaScript as a set of simple mathematical formulas with a very precise meaning, and once I understood the language and its security properties (by proving several mathematical results), I studied the way Facebook restricts JavaScript and found several flaws. A malicious user could have written bad Facebook applications, able to steal information and damage the profile or the web browser of other users. I contacted the Facebook team and discussed possible solutions, and they modified their restriction mechanism accordingly.This is just an example of how the work I am proposing consists in original foundational research that also has direct impact on the life of millions of people. Following a similar approach I will also model the languages that are used to program web servers, such as PHP, and the browser with its DOM libraries, and study their security properties. I will participate in the definition of standards related to web security, and influence the design of several major web applications such as the future versions of the iGoogle portal, Yahoo!'s advertising platform and the Microsoft Web Sandbox framework for mashups. I have already met researchers from these companies, all interested in receiving input from this line of research.