TC: Medium: Collaborative Research: Program Analysis for Smartphone Application Security

TC：媒介：协作研究：智能手机应用程序安全的程序分析

• 批准号: 1064646
• 负责人: Iulian Neamtiu
• 金额: $ 36.59万
• 依托单位: University of California-Riverside
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2011
• 资助国家: 美国
• 起止时间: 2011-04-15 至 2016-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1064646&HistoricalAwards=false
• 关键词: TC; Medium; Collaborative; Research; Program

This project investigates a new approach for describing and reasoning about security properties of smartphone applications. Smartphones are becoming pervasive, and smartphone applications are increasingly used for a variety of social, health, scientific, and military purposes. However, the capabilities these phones provide, such as access to GPS, camera, Internet, calendar, contacts, and other sensitive information can lead to major security risks. Today's smartphone development methodologies do little to help developers construct applications that safely access sensitive resources.The goal of this project is to develop new program analysis techniques that can help developers express, reason about, and enforce security policies in smartphones. The proposed technical approach will allow developers to define rich security policies in an intuitive and flexible manner: as program code that interacts with a mobile application and checks desired properties. To ensure that application code conforms to such policies, the project is pursuing several techniques that leverage recent advances in static and dynamic program analysis. The project is also investigating approaches to automatically synthesize a code-based policy for a given application. The project is instantiating these ideas in the context of Google's Android operating system, and is evaluating the ideas in terms of effectiveness and performance on a broad range of Android-based smartphone applications.

该项目研究了一种新的方法，用于描述和推理智能手机应用程序的安全属性。 智能手机正变得普遍，智能手机应用程序越来越多地用于各种社会，健康，科学和军事用途。但是，这些手机提供的功能，例如访问GPS，相机，Internet，日历，联系人和其他敏感信息可能会导致重大安全风险。 当今的智能手机开发方法无济于事，可以帮助开发人员构建安全访问敏感资源的应用程序。该项目的目的是开发新的程序分析技术，这些技术可以帮助开发人员在智能手机中表达，推理和执行安全策略。 提出的技术方法将使开发人员能够直观且灵活地定义丰富的安全策略：作为与移动应用程序交互并检查所需属性的程序代码。 为了确保应用代码符合此类政策，该项目正在采用几种利用静态和动态程序分析的最新进展的技术。 该项目还正在研究为给定应用程序自动合成基于代码的策略的方法。该项目是在Google的Android操作系统的背景下实例化这些想法的，并且正在评估在广泛的基于Android的智能手机应用程序上的有效性和性能方面的想法。