Secure web applications via automatic partitioning

Abstract

Web applications are now critical infrastructure. To improve the user interface, some application functionality is typically implemented as client-side JavaScript code. Currently there are no good methods for deciding when it is secure to move code and data to the client side. Swift is a new, principled approach to building web applications that are secure by construction. Application code is written as Java-like code annotated with information flow policies. This code is automatically partitioned between JavaScript code running in the browser, and Java code running on the server. Code and data are placed on the client side where possible. Security-critical code is placed on the server and user interface code is placed on the client. Code placement is constrained by high-level, declarative information flow policies that strongly enforce the confidentiality and integrity of server-side information.Web applications are hard to build because code and data needs to be partitioned to make them responsive. They are also hard to build because code and data need to be partitioned for security. Because of the connection (and tension) between the two problems, Swift addresses both at once, automatically partitioning application code while also providing assurance that the resulting placement is secure and efficient.

Dynamic vs. Static Flow-Sensitive Security Analysis

“…Several informationflow tools have been developed for mainstream languages, e.g., Java-based Jif [35], Caml-based FlowCaml [46], and Ada-based SPARK Examiner [8], [11], as well as case studies [46], [3], [23], [13], [12], [15], [38]. Informationflow analysis is becoming particularly attractive for web applications (e.g, [13], [12], [49], [30]), where the challenge is to secure the manipulation of secret and public data on both server and client side.…”

Embedded Computing : Partitioning the Software between Clients and Servers

“…For the remaining part of the application, we will first determine: which part of the state is to be kept local and which one to keep global ie, how to partition the remaining application? There are several issues faced in deciding the partitioning [6]- [7].…”

Practical Secure Two-Party Computation

“…Generally they accept as input a program written in a Turingcomplete programming language, which can be either imperative [74,15,47,73,83,110,108,25,26,72] or descriptive [97]. The systems outputs can be boolean circuits [74,15,47], source code in a generic programming language [73,110,108,25,26,72], or a running protocol [97]. Some systems [74,15,47,97,73] employed cryptographic primitives to enable secure computation, whereas others [110,108,25,26,72,83] did not.…”

“…The systems outputs can be boolean circuits [74,15,47], source code in a generic programming language [73,110,108,25,26,72], or a running protocol [97]. Some systems [74,15,47,97,73] employed cryptographic primitives to enable secure computation, whereas others [110,108,25,26,72,83] did not. Instead, they were designed as tools that use types or annotations to specify security properties and apply various static analysis techniques to ensure the security requirements are met.…”

“…Many language and analysis tools provide means to specify and check privacy requirements and trust relationship for program data [110,108,25,26,72]. For example, Jif/split [108] can automatically partition programs into a number of slices according to the annotated security types and trust labels.…”