开放式Web平台可信性:问题与对策

开放式Web平台可信性:问题与对策 Trustworthiness of the Open Web Platform:Challenges and Countermeasures 屈宇 QU Yu1 1 2 first-author 管晓宏 GUAN Xiaohong1 1 2 3 4 郑庆华 ZHENG Qinghua1 1 2 何岚 HE Lan1 1 2 吕复强 L Fuqiang1 1 2 王志文 WANG Zhiwen1 1 2 西安交通大学智能网络与网络安全教育部重点实验室 西安交通大学智能网络与网络安全教育部重点实验室 Key Laboratory for Intelligent Networks and Network Security of Ministry of EducationXi’an Jiaotong University Key Laboratory for Intelligent Networks and Network Security of Ministry of EducationXi’an Jiaotong University 机械制造系统工程国家重点实验室 机械制造系统工程国家重点实验室 State Key Laboratory for Manufacturing Systems,Xi’an Jiaotong University State Key Laboratory for Manufacturing Systems,Xi’an Jiaotong University 清华大学自动化系 清华大学自动化系 Department of Automation,Tsinghua University Department of Automation,Tsinghua University 清华大学清华信息科学与技术国家实验室 清华大学清华信息科学与技术国家实验室 Tsinghua National Laboratory for Information Science and Technology,Tsinghua University Tsinghua National Laboratory for Information Science and Technology,Tsinghua University 对近期出现的开放式Web平台共性特征进行了分析,提出了开放式Web平台由于其系统架构,在可用性、安全性及隐私性等方面存在的问题,并通过实验证明了上述问题的存在.对于增强此类系统可信性,本文认为应重视由RESTfulWebServices远程调用所带来的时间开销,在第三方服务器暂存请求副本并增加DDoS攻击检测功能;开放式Web平台应对其与第三方应用服务器之间的通信进行加密.提出了一种基于任意测试位置的第三方应用评测算法,该算法仅使用较少的测试数据.实验表明,该算法能有效检测存在安全性及隐私性漏洞的第三方应用. The Open Web Platform,which emerged recently,is attracting increasing attention in industry. In this paper,the common characteristics of the Open Web Platform are investigated. We show that the Open Web Platform’s availability,privacy and security can be exploited easily due to its architectural design. Thus,the trustworthiness of such platform can be undermined easily. Experiments are taken to support the preceding hypothesis. Several suggestions aiming to improve the trustworthiness of such Platform are proposed. This paper presents a new evaluating approach to test third party applications in the Open Web Platform. This approach is only based on simple testing records. Experiments show that this approach can discover the vulnerable third party applications effectively. Web平台 可信性 开放平台 测试 Web platform trustworthiness open platform testing 10.14188/j.1671-8836.2010.04.026 TP393.08 国家自然科学基金委员会创新研究群体科学基金（60921003）;国家自然科学基金（60574087,60970121）;国家杰出青年基金资助项目（60825202）;国家“十一五”科技支撑计划重点课题（2006BAK11B02）;国家高技术研究发展计划（863）项目（2007AA01Z475,2007AA01Z480,2007AA01Z464,2008AA01Z415） 2010-04-01 2021-04-01 4 56