SaTC: CORE: Medium: WebSheets: A New Privacy-Centric Framework for Web Applications

点击翻译按钮获取中文摘要

The success of spreadsheets stems from an average user's ability to create applications in a tabular format without needing traditional programming skills. This project develops a novel formulation of spreadsheets called WebSheets for developing privacy-centric web applications. A WebSheets user need only master a skill set comparable to a conventional spreadsheet user in order to develop web applications centered around organizing and interacting with sensitive, tabular data. Key outcomes will include a WebSheet formula language and compiler, a secure and efficient evaluation engine for this language, and novel analysis and learning techniques to help users understand and improve policies and debug policy errors.WebSheets addresses many key intellectual challenges in securing today's web applications. As defenses against lower-level vulnerabilities (e.g., SQL injection) are more widely deployed, attackers target higher-level errors such as missing or incorrect access policies and their enforcement. These attacks are effective because today's data owners cannot directly express their desired policies. Moreover, ensuring the correct placement of all necessary security checks is a hard problem. Finally, implementation vulnerabilities may be exploited by attackers to bypass policies. WebSheets addresses these challenges by globally enforcing data owners' privacy policies, and using least-privilege evaluation to bound damage from vulnerabilities. Data privacy and security are important problems facing the society. This project provides a technical basis for data owners to gain control over the use and dissemination of institutional and/or personal data. Project results will be disseminated via publications and open-source software hosted at http://seclab.cs.stonybrook.edu/This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.