A University of Illinois at Chicago researcher is working on a tool for C programmers designed to help them build applications that are much less likely to reveal your personal data. He recently received a $250,000 National Science Foundation grant.
“There are many ways software can leak information, and often programmers are clueless about how to prevent it,” said V.N. Venkatakrishnan , assistant professor of computer science and co-director of UIC’s Center for Research and Instruction in Technologies for Electronic Security, in a statement.
While Internet users might be reassured by Web pages that their transactions are secure along the network, Venkatakrishnan’s concern is what becomes of that data once it reaches a computer, such as at a retailer. The key is making sure e-mail, Web browser and other programs are written with more security in mind from the start, he said.
“It is important to address end-user privacy concerns during software development,” he said in a statement.
The software his team is developing separates public from private information in applications and monitors it to keep private data hidden from prying eyes.
“Taken together, the public and private zones replace the original functionality of the program,” he said in a statement. “It enables you to enforce different policies on these zones. For instance, the public zone is not allowed to read sensitive data, and the private zone is not allowed network access, which addresses end-user privacy concerns.”
Venkatakrishnan plans to use the grant money to move from prototype and medium-scale software program testing to large-scale software program testing. His hope is to have a publicly available tool ready within two years.
Securing software programs from the start has become an increased focus for software companies and the issue has been a major topic of conversation at security conferences this year, including the RSA Conference held in February. Vulnerability assessment has also been a focus of security start-ups.
