一句话：提出零信任依赖方法 ZTD_Sys 与 Java 原型 ZTD_JAVA，以最小权限和持续监控防御软件供应链漏洞。
第三方库如 Log4j 加速了软件开发，却带来严重的供应链风险：当前应用运行时隐式信任这些库，使其一旦含漏洞便可危害宿主系统资源。本文提出「零信任依赖」，将 NIST 零信任架构（安全资源访问、持续监控、最小权限执行）应用于软件应用。作者首先通过一项关于第三方库及其漏洞的研究，评估零信任依赖的预期有效性与配置成本；随后给出系统设计 ZTD_Sys 以及面向 Java 应用的 ZTD_JAVA 原型。在重现漏洞与真实应用上的评估表明，ZTD_JAVA 能防御常见漏洞类别，引入的运行时开销可忽略，且易于配置和使用。
Third-party libraries like Log4j accelerate software application development but introduce substantial risk. Vulnerabilities in these libraries have led to Software Supply Chain (SSC) attacks that compromised resources within the host system. These attacks benefit from current application permissions approaches: third-party libraries are implicitly trusted in the application runtime. An application runtime designed with ZeroTrust Architecture (ZTA) principles - secure access to resources, continuous monitoring, and least-privilege enforcement - could mitigate SSC attacks, as it would give zero implicit trust to these libraries. However, no individual security defense incorporates these principles at a low runtime cost. This paper proposes Zero-Trust Dependencies to mitigate SSC vulnerabilities: we apply the NIST ZTA to software applications. First, we assess the expected effectiveness and configuration cost of Zero-Trust Dependencies using a study of third-party software libraries and their vulnerabilities. Then, we present a system design,$\text{ZTD}_{\text{Sys}}$, that enables the application of Zero-Trust Dependencies to software applications and a prototype,$\text{ZTD}_{\text{JAVA}}$, for Java applications. Finally, with evaluations on recreated vulnerabilities and realistic applications, we show that$\text{ZTD}_{\text{JAVA}}$can defend against prevalent vulnerability classes, introduces negligible cost, and is easy to configure and use.
DOI 原文 ·
@inproceedings{paperbot8868,
title = {$ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies},
author = {Paschal C. Amusuo and Kyle A. Robinson and Tanmay Singla and Huiyun Peng and Aravind Machiry and Santiago Torres-Arias and Laurent Simon and James C. Davis},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00148}
}