TC: Small: To Configure or to Implement, That is the Access Control Question for Web Applications

点击翻译按钮获取中文摘要

As the Web is playing a more and more important role in our lives,it has become criminals' preferred targets. Web-based vulnerabilities now outnumber traditional computer security concerns. We believe that the root cause of many of these attacksis the Web's current access control models: they arefundamentally inadequate to satisfy the protection needs of today's web.The objective of this project is to re-design the access control modelsfor the Web to fix the security problems at the fundamental level. We target two essential components of the Web infrastructure: browser and database. We have designed a generic access control model for web browsersto enforce the browser-side access control needs of webapplications. The model replaces the web's current Same Origin Policy (SOP) model,which is the culprit of many of the security problems. The success of this task will help significantly reduce the number of security problems at the browser side.We have also designed DAC-DB, a Discretionary Access Control (DAC) model for database to automate the enforcement of DAC inweb applications. With this model, web application developers can be liberated from implementing the complicated and error-prone security enforcement logics. Both access control models are designed based on the well-established security principles.To help disseminate our results, we will implement our designs for open-source web browsers and databases, and persuade the webcommunity to adopt our models. The outcome of this research will alsobe converted to hands-on labs to enhance students' learning insystem security.