ESCUDO: A fine-grained protection model for web browsers

Karthick Jayaraman, Wenliang Du, Balamurugan Rajagopalan, Steve J. Chapin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

28 Scopus citations

Abstract

Web applications are no longer simple hyperlinked documents. They have progressively evolved to become highly complex - web pages combine content from several sources (with varying levels of trustworthiness), and incorporate significant portions of client-side code. However, the prevailing web protection model, the same-origin policy, has not adequately evolved to manage the security consequences of this additional complexity. As a result, web applications have become attractive targets of exploitation. We argue that this disconnection between the protection needs of modern web applications and the protection models used by web browsers that manage those applications amounts to a failure of access control. In this paper, we present ESCUDO, a new web browser protection model designed based on established principles of mandatory access control. We describe our implementation of a prototype of ESCUDO in the Lobo web browser, and illustrate how web applications can use ESCUDO for securing their resources. Our evaluation results indicate that ESCUDO incurs low overhead. To support backwards compatibility, ESCUDO defaults to the same-origin policy for legacy applications.

Original languageEnglish (US)
Title of host publicationICDCS 2010 - 2010 International Conference on Distributed Computing Systems
Pages231-240
Number of pages10
DOIs
StatePublished - Aug 27 2010
Event30th IEEE International Conference on Distributed Computing Systems, ICDCS 2010 - Genova, Italy
Duration: Jun 21 2010Jun 25 2010

Publication series

NameProceedings - International Conference on Distributed Computing Systems

Other

Other30th IEEE International Conference on Distributed Computing Systems, ICDCS 2010
CountryItaly
CityGenova
Period6/21/106/25/10

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'ESCUDO: A fine-grained protection model for web browsers'. Together they form a unique fingerprint.

  • Cite this

    Jayaraman, K., Du, W., Rajagopalan, B., & Chapin, S. J. (2010). ESCUDO: A fine-grained protection model for web browsers. In ICDCS 2010 - 2010 International Conference on Distributed Computing Systems (pp. 231-240). [5541712] (Proceedings - International Conference on Distributed Computing Systems). https://doi.org/10.1109/ICDCS.2010.71