ShadowCrypt: Encrypted Web Applications for Everyone

被引：59

作者：

He, Warren ^{[1
]}

Akhawe, Devdatta ^{[1
]}

Jain, Sumeet ^{[1
]}

Shi, Elaine ^{[2
]}

Song, Dawn ^{[1
]}

机构：

[1] Univ Calif Berkeley, Berkeley, CA 94720 USA

[2] Univ Maryland, Baltimore, MD 21201 USA

来源：

CCS'14: PROCEEDINGS OF THE 21ST ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY | 2014年

基金：

美国国家科学基金会;

关键词：

D O I：

10.1145/2660267.2660326

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

A number of recent research and industry proposals discussed using encrypted data in web applications. We first present a systematization of the design space of web applications and highlight the advantages and limitations of current proposals. Next, we present ShadowCrypt, a previously unexplored design point that enables encrypted input/output without trusting any part of the web applications. ShadowCrypt allows users to transparently switch to encrypted input/output for text-based web applications. ShadowCrypt runs as a browser extension, replacing input elements in a page with secure, isolated shadow inputs and encrypted text with secure, isolated cleartext. ShadowCrypt's key innovation is the use of Shadow DOM, an upcoming primitive that allows low-overhead isolation of DOM trees. Evaluation results indicate that ShadowCrypt has low overhead and of practical use today. Finally, based on our experience with ShadowCrypt, we present a study of 17 popular web applications, across different domains, and the functionality impact and security advantages of encrypting the data they handle.

引用

页码：1028 / 1039

页数：12

共 41 条

[31] Bootstrapping Trust in Commodity Computers [J].

Parno, Bryan ;

McCune, Jonathan M. ;

Perrig, Adrian .

2010 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, 2010, :414-429

[32]

Popa RA, 2011, SOSP 11: PROCEEDINGS OF THE TWENTY-THIRD ACM SYMPOSIUM ON OPERATING SYSTEMS PRINCIPLES, P85

[33]

Popa RalucaAda., 2014, NDSI

[34] User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems [J].

Roesner, Franziska ;

Kohno, Tadayoshi ;

Moshchuk, Alexander ;

Parno, Bryan ;

Wang, Helen J. ;

Cowan, Crispin .

2012 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP), 2012, :224-238

[35] Fuzzy identity-based encryption [J].

Sahai, A ;

Waters, B .

ADVANCES IN CRYPTOLOGY - EUROCRYPT 2005,PROCEEDINGS, 2005, 3494 :457-473

[36]

Sekar V, 2011, PROCEEDINGS OF THE 3RD ACM WORKSHOP CLOUD COMPUTING SECURITY WORKSHOP (CCSW'11), P21

[37] Symmetric Cryptography in Java']Javascript [J].

Stark, Emily ;

Hamburg, Michael ;

Boneh, Dan .

25TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE, 2009, :373-381

[38]

STONE P., PIXEL PERFECT TIMING

[39] A Language for Automatically Enforcing Privacy Policies [J].

Yang, Jean ;

Yessenov, Kuat ;

Solar-Lezama, Armando .

ACM SIGPLAN NOTICES, 2012, 47 (01) :85-96

[40]

YAO A. C.-C., 1986, IEEE S FDN COMP SCI

← 1 2 3 4 5 →