A measurement study of the subresource integrity mechanism on real-world applications
A measurement study of the subresource integrity mechanism on real-world applications
复制标题
实际应用中子资源完整性机制的度量研究
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Kailas Patil
中科院分区：
文献类型：
--
作者：
Ronak Shah;Kailas Patil
如今，用户只需点击一下即可访问数十亿个网站，为他们提供所需的适当服务。这些网站大多依赖第三方托管的资源来提供丰富的功能。子资源完整性 (SRI) 是一种提供检查第三方托管资源完整性的方法的机制。本文提供了使用 SRI 的网站的详细统计数据。这项研究还解决了 SRI 实施的不同方面，例如 SRI 采用和故障转移管理中的不一致，并且还估计了采用 SRI 所需的工作量。这项研究首先确定了 SRI 实施的不同问题，然后提供了一种缓解这些问题的方法，使 SRI 的采用更加容易且无差错。我们实现了一个名为 UserSRI 的工具作为浏览器扩展。 UserSRI 使用动态分析来推断 SRI 机制，方便测试，并赋予精明的用户在网站上执行客户端策略的权限。
Today, billions of websites are available to users in just a click to give them required and appropriate service. Most of these websites provide rich functionalities by relying on third-party-hosted resources. Subresource integrity (SRI) is a mechanism that provides ways to examine the integrity of third-party-hosted resources. This paper provides detailed statistics on websites that are using SRI. This research also addresses different aspects of SRI implementation, such as inconsistency in the adoption of SRI and failover management, and it also estimates the amount of effort required to adopt SRI. This research first identifies different issues of SRI implementation and then provides a way to mitigate these issues and make adoption of SRI easier and error-free. We implemented a tool called UserSRI as a browser extension. UserSRI uses dynamic analysis to infer the SRI mechanism, facilitates testing, and gives savvy users the authority to enforce client-side policies on websites.