Skip to main content

Automating isolation and least privilege in web services

Author(s): Blankstein, A; Freedman, Michael J.

To refer to this page use:
Abstract: In many client-facing applications, a vulnerability in any part can compromise the entire application. This paper describes the design and implementation of Passe, a system that protects a data store from unintended data leaks and unauthorized writes even in the face of application compromise. Passe automatically splits (previously shared-memory-space) applications into sandboxed processes. Passe limits communication between those components and the types of accesses each component can make to shared storage, such as a backend database. In order to limit components to their least privilege, Passe uses dynamic analysis on developer-supplied end-to-end test cases to learn data and control-flow relationships between database queries and previous query results, and it then strongly enforces those relationships. Our prototype of Passe acts as a drop-in replacement for the Django web framework. By running eleven unmodified, off-the-shelf applications in Passe, we demonstrate its ability to provide strong security guarantees-Passe correctly enforced 96% of the applications' policies-with little additional overhead. Additionally, in the web-specific setting of the prototype, we also mitigate the cross-component effects of cross-site scripting (XSS) attacks by combining browser HTML5 sandboxing techniques with our automatic component separation
Publication Date: 20-Nov-2014
Electronic Publication Date: 2014
Citation: Blankstein, A, Freedman, MJ. (2014). Automating isolation and least privilege in web services. 133 - 148. doi:10.1109/SP.2014.16
DOI: doi:10.1109/SP.2014.16
Pages: 133 - 148
Type of Material: Conference Article
Journal/Proceeding Title: 35th IEEE Symposium on Security and Privacy, SP 2014
Version: Final published version. This is an open access article.

Items in OAR@Princeton are protected by copyright, with all rights reserved, unless otherwise indicated.