Document Type
Report
Date
7-14-2011
Keywords
Web Security, access control, web application
Language
English
Disciplines
Computer Sciences
Description/Abstract
The Web is playing a very important role in our lives, and is becoming an essential element of the computing infrastructure. Unfortunately, its importance makes it the preferred target of attacks. Web-based vulnerabilities now outnumber traditional computer security concerns. A recent study shows that over 80 percent of web sites have had at least one serious vulnerability. We believe that the Web’s problems, to a large degree, are caused by the inadequacy of its underlying access control systems. To reduce the number of vulnerabilities, it is essential to provide web applications with better access control models that can adequately address the protection needs of the current Web. As a part of the efforts to develop a better access control system for the Web, we focus on the server-side access control in this paper. We introduce a new concept called subsession, based on which, we have developed a ringbased access control system (called Scuta) for web servers. Scuta provides a fine-grained and backward-compatible access control mechanism for web applications. We have implemented Scuta in PHP, and have conducted comprehensive case studies to evaluate its benefits.
Recommended Citation
Tan, Xi; Du, Wenliang; Luo, Tongbo; and Jayaraman, Karthick, "SCUTA: A Server-Side Access Control System for Web Applications" (2011). Electrical Engineering and Computer Science - Technical Reports. 45.
https://surface.syr.edu/eecs_techreports/45
Source
local
Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.
