Research On The Fine-grained Information Flow Control Model For Web Platform

The current Web application is a collection of JavaScript written by multiple authors: Developers often integrate code from third parties,and mashup applications need to integrate data and code hosted on different sites.However,present browsers lack a sufficient mechanism for confining untrusted third-party code,and thus cannot guarantee the security of users' privacy and the integrity of applications.For the security issues caused by the third-party code,we study the characteristics and security needs of various types of Web applications,and propose the JavaScript confinement system that introduces the label-based fine-grained information flow control model,which satisfies the principle of separation of duties and principle of least privilege,and can efficiently prevent privacy disclosure and guarantee the integrity of the application.The model introduces two different granularities of information-flow labels,namely,the context label and the message label,and implements a flexible and accurate flow control policies by tracking these dynamically changing labels.The context label,which is assigned to the component of browser,represents the privilege of all data within the relevant component.It can not only express secrecy and integrity but also precisely define the endorsement and declassification operations.The message label,which is assigned to a transferred message,represents that the labeled message contains private information of relevant component.The model can use the message label to track sensitive data,and prevent the privacy disclosure.In addition,we analyze and validate the security of the model by demonstrating the non-interference which is the important attribute of information flow control technology.Finally,we implement a fine-grained information flow control prototype system JSFfox,and conduct the function and performance experiment.The results show that with acceptable overhead,the prototype system can implement flexible and fine-grained information flow control policies,and effectively protect the users' privacy and applications' integrity.