TrustJS: Trusted Client-side Execution of JavaScript
TrustJS: Trusted Client-side Execution of JavaScript
复制标题
DOI：
10.1145/3065913.3065917
复制
发表时间：
2017-04
期刊：
影响因子：
--
通讯作者：
David Goltzsche;C. Wulf;D. Muthukumaran;Konrad Rieck;P. Pietzuch;R. Kapitza
中科院分区：
文献类型：
--
作者：
David Goltzsche;C. Wulf;D. Muthukumaran;Konrad Rieck;P. Pietzuch;R. Kapitza
客户端JavaScript在Web应用程序中无处不在，以改善用户体验并减少服务器负载。然而，由于客户端是不可信的，服务器不能依赖于客户端JavaScript代码及其操作的数据的机密性或完整性。例如，客户端输入验证必须在服务器端重复，机密业务逻辑不能卸载。在本文中，我们提出了TrustJS，一个框架，使商品浏览器内的安全敏感的JavaScript的可信执行。TrustJS利用英特尔SGX提供的可信硬件支持来保护JavaScript的客户端执行，从而实现Web应用程序代码的灵活分区。我们介绍了TrustJS的设计，并提供了初步的评估结果，表明可信的JavaScript卸载可以进一步改善用户体验，节省更多的服务器资源。
Client-side JavaScript has become ubiquitous in web applications to improve user experience and reduce server load. However, since clients are untrusted, servers cannot rely on the confidentiality or integrity of client-side JavaScript code and the data that it operates on. For example, client-side input validation must be repeated at server side, and confidential business logic cannot be offloaded. In this paper, we present TrustJS, a framework that enables trustworthy execution of security-sensitive JavaScript inside commodity browsers. TrustJS leverages trusted hardware support provided by Intel SGX to protect the client-side execution of JavaScript, enabling a flexible partitioning of web application code. We present the design of TrustJS and provide initial evaluation results, showing that trustworthy JavaScript offloading can further improve user experience and conserve more server resources.