Building Secure Web Applications with Automatic Partitioning.
Swift is a new, principled approach to building Web applications that are secure by construction. Modern Web applications typically implement some functionality as client-side JavaScript code, for improved interactivity. Moving code and data to the client can create security vulnerabilities, but cur...
| Publicado en: | Communications of the ACM Vol. 52; no. 2; pp. 79 - 88 |
|---|---|
| Autores principales: | , , , , , , |
| Formato: | Artículo |
| Publicado: |
Association for Computing Machinery
Feb2009
|
| Materias: | |
| Acceso en línea: | Ver este registro en EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=36673339&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 36673339 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 00010782 ACM jtl: Communications of the ACM issn: 00010782 maglogo: N pubinfo: dt: Feb2009 vid: 52 iid: 2 pid: 68 pub: Association for Computing Machinery artinfo: ui: 36673339 10.1145/1461928.1461949 ppf: 79 ppct: 9 formats: tig: atl: Building Secure Web Applications with Automatic Partitioning. aug: au: Chong, Stephen Jed Liu Myers, Andrew C. Xin Qi Vikram, K. Lantian Zheng Xin Zheng affil: Department of Computer Science Cornell University. su: World Wide Web Computer programming JavaScript programming language Client/server computing Internet software Automation sug: subj: World Wide Web Computer programming JavaScript programming language Client/server computing Internet software Automation ab: Swift is a new, principled approach to building Web applications that are secure by construction. Modern Web applications typically implement some functionality as client-side JavaScript code, for improved interactivity. Moving code and data to the client can create security vulnerabilities, but currently there are no good methods for deciding when it is secure to do so. Swift automatically partitions application code while providing assurance that the resulting placement is secure and efficient. Application code is written as Java-like code annotated with information flow policies that specify the confidentiality and integrity of Web application information. The compiler uses these policies to automatically partition the program into JavaScript code running in the client browser and Java code running on the server. To improve interactive performance, code and data are placed on the client. However, security-critical code and data are always placed on the server. The compiler may also automatically replicate code across the client and server, to obtain both security and performance. pubtype: Periodical doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2009 holdings: @attributes: islocal: N |
|---|