NDLI: Lightweight self-protecting JavaScript

Please wait, while we are loading the content...

Securing virtual machine monitors: what is needed?

Automatic discovery of botnet communities on large-scale communication networks

Efficient IRM enforcement of history-based access control policies

On the feasibility of launching the man-in-the-middle attacks on VoIP from remote attackers

On-board credentials with open provisioning

Universally composable contributory group key exchange

Unconditionally secure message transmission in arbitrary directed synchronous networks tolerating generalized mixed adversary

Efficient zero-knowledge identification schemes which respect privacy

Expressive policy analysis with enhanced system dynamicity

Confidentiality-preserving distributed proofs of conjunctive queries

Conditional proxy re-encryption secure against chosen-ciphertext attack

Logging key assurance indicators in business processes

A note on Cook's elastic block cipher

Assured information sharing between trustworthy, semi-trustworthy and untrustworthy coalition partners

Automating analysis of large-scale botnet probing events

Lightweight self-protecting JavaScript

A generic construction of useful client puzzles

Flexible μTPMs through disembedding

Universal forgery of the identity-based sequential aggregate signature scheme

Formalizing information security knowledge

Quantifying maximal loss of anonymity in protocols

Semantic context aware security policy deployment

D-algebra for composing access control policy decisions

An ID-based authenticated key exchange protocol based on bilinear Diffie-Hellman problem

Anonymous user communication for privacy protection in wireless metropolitan mesh networks

A conceptual framework for Group-Centric secure information sharing

Towards complete node enumeration in a peer-to-peer botnet

An integrated approach to detection of fast and slow scanning worms

A chipset level network backdoor: bypassing host-based firewall & IDS

Partnership in key exchange protocols

The union-split algorithm and cluster-based anonymization of social networks

PBES: a policy based encryption system with application to data sharing in the power grid

Toward practical analysis for trust management policy

Provably secure and efficient bounded ciphertext policy attribute based encryption

Delegate predicate encryption and its application to anonymous authentication

Intrusion response cost assessment methodology

Authenticated wireless roaming via tunnels: making mobile guests feel at home

TimeVM: a framework for online intrusion mitigation and fast recovery using multi-time-lag traffic replay

Hidden credential retrieval from a reusable password

Attribute based proxy re-encryption with delegating capabilities

A new hash family obtained by modifying the SHA-2 family

Improved searchable public key encryption with designated tester

Lightweight self-protecting JavaScript

Content Provider	ACM Digital Library
Author	Chudnov, Andrey Phung, Phu H. Sands, David
Abstract	This paper introduces a method to control JavaScript execution. The aim is to prevent or modify inappropriate behaviour caused by e.g. malicious injected scripts or poorly designed third-party code. The approach is based on modifying the code so as to make it self-protecting: the protection mechanism (security policy) is embedded into the code itself and intercepts security relevant API calls. The challenges come from the nature of the JavaScript language: any variables in the scope of the program can be redefined, and code can be created and run on-the-fly. This creates potential problems, respectively, for tamper-proofing the protection mechanism, and for ensuring that no security relevant events bypass the protection. Unlike previous approaches to instrument and monitor JavaScript to enforce or adjust behaviour, the solution we propose is lightweight in that (i) it does not require a modified browser, and (ii) it does not require any run-time parsing and transformation of code (including dynamically generated code). As a result, the method has low run-time overhead compared to other methods satisfying (i), and the lack of need for browser modifications means that the policy can even be applied on the server to mitigate some effects of cross-site scripting bugs.
Starting Page	47
Ending Page	60
Page Count	14
File Format	PDF
ISBN	9781605583945
DOI	10.1145/1533057.1533067
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2009-03-10
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Inlined reference monitors Javascript Programming Language based security
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Inlined monitors for security policy enforcement in web applications

Efficient IRM enforcement of history-based access control policies

Lightweight Inlined Reference Monitors for Securing Extensible and Open Systems

Lightweight Inlined Reference Monitors for Securing Extensible and Open Systems

Virtual ghost: protecting applications from hostile operating systems

Lightweight Self-Protecting JavaScript (2008)

Lightweight self-protecting javascript (2009).

Self-Protecting JavaScript Based on Hierarchical Control

Inlined Information Flow Monitoring for JavaScript

Lightweight self-protecting JavaScript

Similar Documents

Inlined monitors for security policy enforcement in web applications

Efficient IRM enforcement of history-based access control policies

Lightweight Inlined Reference Monitors for Securing Extensible and Open Systems

Lightweight Inlined Reference Monitors for Securing Extensible and Open Systems

Virtual ghost: protecting applications from hostile operating systems

Lightweight Self-Protecting JavaScript (2008)

Lightweight self-protecting javascript (2009).

Self-Protecting JavaScript Based on Hierarchical Control

Inlined Information Flow Monitoring for JavaScript

Lightweight self-protecting JavaScript