TC: Medium: Collaborative Research: Next-Generation Infrastructure for Trustworthy Web Applications

点击翻译按钮获取中文摘要

Many services traditionally performed by stand-alone programs running on desktop computers are being migrated to ?Web 2.0? applications, remote services that reside ?in the cloud? and are that accessed through a browser. This migration process offers a unique opportunity to re-engineer the way that software is constructed, adding some extra capabilities that reduce the vulnerability of the global information infrastructure to problems such as viruses, cyber-attacks, loss of privacy, and integrity violations. With this goal in mind, this project designs and implements a next-generation infrastructure for trustworthy web applications. It evolves the existing Web 2.0 technologies into a more trustworthy ?Web 2.Sec? version by introducing information-labeling and strong information-flow controls pervasively at the service provider, at the user?s end, and on all paths in between. A key feature of the new Web 2.Sec architecture is that all application programs are executed on top of a virtual machine (VM) rather than directly on physical hardware. Hence the VM retains full control over the data at all times, allowing it to enforce information-flow policies that guarantee confidentiality and integrity. Even a malicious or faulty program running on top of the Web 2.Sec VM cannot cause any action that would violate these policies. A strong educational component involving both graduate and undergraduate students rounds off the project.