ShadowCrypt: Encrypted Web Applications for Everyone

被引：59

作者：

He, Warren ^{[1
]}

Akhawe, Devdatta ^{[1
]}

Jain, Sumeet ^{[1
]}

Shi, Elaine ^{[2
]}

Song, Dawn ^{[1
]}

机构：

[1] Univ Calif Berkeley, Berkeley, CA 94720 USA

[2] Univ Maryland, Baltimore, MD 21201 USA

来源：

CCS'14: PROCEEDINGS OF THE 21ST ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY | 2014年

基金：

美国国家科学基金会;

关键词：

D O I：

10.1145/2660267.2660326

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

A number of recent research and industry proposals discussed using encrypted data in web applications. We first present a systematization of the design space of web applications and highlight the advantages and limitations of current proposals. Next, we present ShadowCrypt, a previously unexplored design point that enables encrypted input/output without trusting any part of the web applications. ShadowCrypt allows users to transparently switch to encrypted input/output for text-based web applications. ShadowCrypt runs as a browser extension, replacing input elements in a page with secure, isolated shadow inputs and encrypted text with secure, isolated cleartext. ShadowCrypt's key innovation is the use of Shadow DOM, an upcoming primitive that allows low-overhead isolation of DOM trees. Evaluation results indicate that ShadowCrypt has low overhead and of practical use today. Finally, based on our experience with ShadowCrypt, we present a study of 17 popular web applications, across different domains, and the functionality impact and security advantages of encrypting the data they handle.

引用

页码：1028 / 1039

页数：12

共 41 条

[1]

Agarwal N., 2007, Queue, V5, P28, DOI [10.1145/1281881.1281890, DOI 10.1145/1281881.1281890]

[2]

AGARWAL N., 2007, P WEB 2 0 SEC WORKSH

[3]

[Anonymous], P 2000 IEEE S SEC PR

[4]

[Anonymous], 2012, CRYPTOCAT BLOG XSS V

[5]

[Anonymous], 2011, LASTPASS BLOG CROSS

[6]

[Anonymous], 2012, 10 USENIX S OPERATIN

[7]

[Anonymous], 1996, J ACM

[8]

Bellarc M, 2009, LECT NOTES COMPUT SC, V5867, P295, DOI 10.1007/978-3-642-05445-7_19

[9] Ciphertext-policy attribute-based encryption [J].

Bethencourt, John ;

Sahai, Amit ;

Waters, Brent .

2007 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, PROCEEDINGS, 2007, :321-+

[10]

Boneh D, 2011, LECT NOTES COMPUT SC, V6597, P253, DOI 10.1007/978-3-642-19571-6_16

← 1 2 3 4 5 →