loading...
Robustness and Security Hardening of COTS Software Libraries
Edinburgh, UK June 25-June 28
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/DSN.2007.8437th Annual IEEE/IFIP International C ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Martin Su?kraut, Technische Universitat Dresden, Germany
Christof Fetzer, Technische Universitat Dresden, Germany
COTS components, like software libraries, can be used to reduce the development effort. Unfortunately, many COTS components have been developed without a focus on robust- ness and security. We propose a novel approach to harden software libraries to improve their robustness and security. Our approach is automated, general and extensible and consists of the following stages. First, we use a static anal- ysis to prepare and guide the following fault injection. In the dynamic analysis stage, fault injection experiments exe- cute the library functions with both usual and extreme input values. The experiments are used to derive and verify one protection hypothesis per function (for instance, function foo fails if argument 1 is a NULL pointer). In the hard- ening stage, a protection wrapper is generated from these hypothesis to reject unrobust input values of library func- tions. We evaluate our approach by hardening a library used by Apache (a web server).
Citation:
Martin Su?kraut, Christof Fetzer, "Robustness and Security Hardening of COTS Software Libraries," dsn, pp.61-71, 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'07), 2007
Usage of this product signifies your acceptance of the Terms of Use.