軟體安全性弱點測試系統

Abstract

軟體安全是實現電腦安全的基礎。隨著網際網路的普及，電腦安全問題也愈受重視。目前許多學者、研究人員都致力於設計更安全的加密理論與通訊協定，網路服務業者也大量提供安全保密的服務。但是，軟體實作方面的安全性分析與測試，卻仍處於研究階段。一套未通過安全性分析的軟體系統可能會因為程式設計師在軟體實作上的疏失，而造成非法使用者入侵的弱點，並更進一步地使其完善的安全機制受到破壞，甚至瓦解整個網路系統的安全架構。在這篇論文中，藉由分析歷年網路安全事件報告，我們歸納出三種常見的軟體安全性弱點問題(vulnerabilities)。針對這些弱點，我們提出一套軟體安全性弱點測試系統，使其能分析軟體系統中的關聯性物件，尋找可能的安全性弱點，並交互使用靜態驗證(static verification)與執行間測試(run-time analyzing)的技術，以達成測試軟體安全性弱點的目的。此系統具有良好的擴充性，可供測試者新增新的測試規則、測試方法，以增進測試結果的正確性與完整性。

In this thesis, a security-testing system is proposed that takes advantage of static verification and run-time analyzing to discover the potential vulnerabilities. Through in-depth investigation of advisories announced by CERT/CC, we realize that coding defects of software are the major part of Internet security incidents. The software should be examined by the security testing system to find out the vulnerabilities before using it. The proposed security-testing system has the ability to retrieve and test the resources that have relationship with the software to be tested. After the testing, those resources are ensured not to cause the penetration. The proposed testing system also provides the extensibility so that the testers can add new testing requirements to complete the testing. Moreover, with the ability of extensibility, undiscovered vulnerabilities can be detected by adding correlative testing rules. A prototype is implemented to prove the feasibility of our system.