App isolation: get the security of multiple browsers with just one
App isolation: get the security of multiple browsers with just one
复制标题
应用程序隔离：仅用一个浏览器即可获得多个浏览器的安全性
DOI：
--
复制
发表时间：
2011
期刊：
影响因子：
--
通讯作者：
Collin Jackson
中科院分区：
文献类型：
--
作者：
E. Chen;Jason Bau;C. Reis;A. Barth;Collin Jackson
许多基于浏览器的攻击可以通过为不同的网站使用不同的浏览器来防止。然而，大多数用户只使用一个浏览器访问Web。我们解释了使用多个浏览器提供的两个概念方面的安全优势：入口点限制和状态隔离。我们将这些概念联合收割机组合到一个通用的应用程序隔离机制中，该机制可以在单个浏览器中提供相同的安全优势。虽然不适合所有类型的网站，但许多拥有高价值用户数据的网站可以选择应用程序隔离，以抵御各种基于浏览器的攻击。我们在Chromium浏览器中实现应用隔离，并使用有限状态模型检查来验证其安全属性。我们还测量了应用程序隔离的性能开销，并进行了大规模的研究，以评估其采用的复杂性，为各种类型的网站，演示应用程序隔离机制是如何适合保护一些高价值的Web应用程序，如网上银行。
Many browser-based attacks can be prevented by using separate browsers for separate web sites. However, most users access the web with only one browser. We explain the security benefits that using multiple browsers provides in terms of two concepts: entry-point restriction and state isolation. We combine these concepts into a general app isolation mechanism that can provide the same security benefits in a single browser. While not appropriate for all types of web sites, many sites with high-value user data can opt in to app isolation to gain defenses against a wide variety of browser-based attacks. We implement app isolation in the Chromium browser and verify its security properties using finite-state model checking. We also measure the performance overhead of app isolation and conduct a large-scale study to evaluate its adoption complexity for various types of sites, demonstrating how the app isolation mechanisms are suitable for protecting a number of high-value Web applications, such as online banking.