A Server-Side JavaScript Security Architecture for Secure Integration of Third-Party Libraries
A Server-Side JavaScript Security Architecture for Secure Integration of Third-Party Libraries
复制标题
用于安全集成第三方库的服务器端 JavaScript 安全架构
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Frank Piessens
中科院分区：
文献类型：
--
作者：
N. V. Ginkel;Willem De Groef;F. Massacci;Frank Piessens
在过去的十年中，用于服务器端编程的JavaScript编程语言的普及度大大提高。Js框架是一个流行的JavaScript服务器端框架，它为基于云的事件驱动架构提供了一个高效的运行时。它的优势之一是存在数以千计的第三方库，允许开发人员快速构建和部署应用程序。这些库本身就是安全威胁的来源，因为一个库中的漏洞可能(在某些情况下确实会)危及整个服务器。为了支持库的安全集成，我们开发了NODESENTRY，这是第一个用于服务器端JavaScript的安全体系结构。我们的策略执行基础设施支持轻松部署网络强化技术和访问控制策略，以实现库与其环境(包括任何从属库)之间的交互。讨论了NODESENTRY的设计和实现，并对其性能和安全性进行了评估。
The popularity of the JavaScript programming language for server-side programming has increased tremendously over the past decade. The Node.js framework is a popular JavaScript server-side framework with an efficient runtime for cloud-based event-driven architectures. One of its strengths is the presence of thousands of third-party libraries which allow developers to quickly build and deploy applications. These very libraries are a source of security threats as a vulnerability in one library can (and in some cases did) compromise an entire server. In order to support the secure integration of libraries, we developed NODESENTRY, the first security architecture for server-side JavaScript. Our policy enforcement infrastructure supports an easy deployment of web hardening techniques and access control policies on interactions between libraries and their environment, including any dependent library. We discuss the design and implementation of NODESENTRY and present its performance and security evaluation.
影响因子：
--
作者：
David Swasey;Deepak Garg;Derek Dreyer
通讯作者：
Derek Dreyer