Document Type
Report
Date
2009
Keywords
Web browsers, access control, web security
Language
English
Disciplines
Computer Engineering
Description/Abstract
Web applications are no longer simple hyperlinked documents. They have progressively evolved to become highly complex---web pages combine content from several sources (with varying levels of trustworthiness), and incorporate significant portions of client-side code. However, the prevailing web protection model, the same-origin policy, has not adequately evolved to manage the security consequences of this additional complexity. As a result, web applications have become attractive targets of exploitation. We argue that this disconnection between the protection needs of modern web applications and the protection models used by web browsers that manage those applications amounts to a failure of access control. In this paper, we present Escudo, a new web browser protection model designed based on established principles of mandatory access control. We describe our implementation of a prototype of Escudo in the Lobo web browser, and illustrate how web applications can use Escudo for securing their resources. Our evaluation results indicate that Escudo incurs low overhead. To support backwards compatibility, Escudo defaults to the same-origin policy for legacy applications.
Recommended Citation
Jayaraman, Karthick; Du, Wenliang; Rajagopalan, Balamurugan; and Chapin, Steve J., "ESCUDO: A Fine-grained Protection Model for Web Browsers" (2009). Electrical Engineering and Computer Science - All Scholarship. 5.
https://surface.syr.edu/eecs/5
Source
local input
Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.
