NDLI: Automating Isolation and Least Privilege in Web Services

Content Provider	IEEE Xplore Digital Library
Author	Blankstein, A. Freedman, M.J.
Copyright Year	2014
Description	Author affiliation: Dept. of Comput. Sci., Princeton Univ., Princeton, NJ, USA (Blankstein, A.; Freedman, M.J.)
Abstract	In many client-facing applications, a vulnerability in any part can compromise the entire application. This paper describes the design and implementation of Passe, a system that protects a data store from unintended data leaks and unauthorized writes even in the face of application compromise. Passe automatically splits (previously shared-memory-space) applications into sandboxed processes. Passe limits communication between those components and the types of accesses each component can make to shared storage, such as a backend database. In order to limit components to their least privilege, Passe uses dynamic analysis on developer-supplied end-to-end test cases to learn data and control-flow relationships between database queries and previous query results, and it then strongly enforces those relationships. Our prototype of Passe acts as a drop-in replacement for the Django web framework. By running eleven unmodified, off-the-shelf applications in Passe, we demonstrate its ability to provide strong security guarantees-Passe correctly enforced 96% of the applications' policies-with little additional overhead. Additionally, in the web-specific setting of the prototype, we also mitigate the cross-component effects of cross-site scripting (XSS) attacks by combining browser HTML5 sandboxing techniques with our automatic component separation.
Starting Page	133
Ending Page	148
File Size	337165
Page Count	16
File Format	PDF
ISBN	9781479946860
ISSN	10816011
DOI	10.1109/SP.2014.16
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-05-18
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Databases Security Runtime Prototypes Browsers Libraries Servers web security security policy inference isolation capabilities principle of least privilege
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Assessing the security of Node.js platform

Develop Web Services for Reliable Cross-Platform Web Applications

Automating isolation and least privilege in web services.

Automating Isolation and Least Privilege in Web Services

Dynamic Thread Count Adaptation for Multiple Services in SMP Environments

Generic Security Policy Transformation Framework for WS-Security

Eliminating SQL Injection Attacks - A Transparent Defense Mechanism

Pivot: Fast, Synchronous Mashup Isolation Using Generator Chains

Constraint-based invocation of stateful web services: The beep store (case study)

Automating Isolation and Least Privilege in Web Services

Similar Documents

Assessing the security of Node.js platform

Develop Web Services for Reliable Cross-Platform Web Applications

Automating isolation and least privilege in web services.

Automating Isolation and Least Privilege in Web Services

Dynamic Thread Count Adaptation for Multiple Services in SMP Environments

Generic Security Policy Transformation Framework for WS-Security

Eliminating SQL Injection Attacks - A Transparent Defense Mechanism

Pivot: Fast, Synchronous Mashup Isolation Using Generator Chains

Constraint-based invocation of stateful web services: The beep store (case study)

Automating Isolation and Least Privilege in Web Services