Subspace Secure Cross Domain Communication for Web Mashups

Subspace: Secure Cross Domain Communication for Web Mashups Collin Jackson and Helen J. Wang Mamadou H. Diallo 1

Overview Motivation Existing approaches <script> tags: uncontrolled cross domain execution - high security risks Browser plugins: cross domain interaction - inconvenient for users Gadget aggregators: inline or sandbox Proposals for cross-domain communication mechanisms Approach: Subspace Mashups: Websites or web applications that combine content from multiple sources Example: www. housingmaps. com, Google Personalized Homepage, Windows Live Issues: current web mashups don’t address security issues Same origin security model A cross-domain communication mechanism Allows efficient and secure communication across domains Provides a communication channel between the aggregator and each gadget Channel: Java. Script objects passed across the frames Protect aggregators against malicious web services and gadgets Implementation Subspace implemented using Java. Script 2

Mashups: Communication across domains Current Practice Same-origin policies Sandbox model Same-origin principle: only the site that stores some information in the browser may read or modify that information Applied loosely: same-origin policies Java. Script restrictions (policies): regulate access to inline frames (IFRAMEs) and XMLHttp. Request Protects the secrecy of HTML documents and the integrity of a page Proxies Cross-domain <script> tags Browser plugins Fragment identifier messaging 3

Subspace Cross-subdomain communication Site: <protocol, hostname, port> Example: Cross-domain code authorization Dynamic authorization Static authorization Cross-domain frame access Permissive Restrictive Configurable Permissive, but restrict location 4

Single Web Service Technique Add a throwaway subdomain Example: Set-up phase 1. Create a mediator frame (hidden frame) 2. Create untrusted frame 3. Pass Java. Script communication object 5

Single Web Service Data Exchange Static authorization model for closures Provides easy communication mechanism between the top frame and the untrusted frame Untrusted frame: adds data request closure to the Java. Script object Argument: data response callback <script> tag: inserted dynamically into the untrusted frame Tag points to some Java. Script format hosted by the web service After loading data from the remote web service, the tag invokes the data response callback Dynamic authorization model for closures Does not support callback system Workaround catch the security exception that is thrown when an unauthorized access occurs 6

Multiple Web Service Challenges Protecting mashup domain Protecting web services from each other Restrictive frame access The scheme for single web service can be directly adopted Use nested frame structure Permissive frame access Examples: Firefox, Safari, IE 7 Separating is much more difficult Configuration: any frame anywhere on the page can be reached by any other frame Solution: use a new throwaway domain for each web service 7

Multiple Web Service Procedure 1. Create mediator frame 2. Create untrusted frame 3. Create access frame 4. Pass Java. Script communication object 5. Cleanup 6. Repeat for every gadget 7. Load untrusted content 8

Evaluation: Mashup Measurements Performance Example mashup Web service 1: Flickr Web service 2: del. icio. us Mashup: Kitten. Mark: allows posting the 20 most recent kitten photos from the Flickr to del. icio. us Three architectures Proxy Unsafe Subsapce Measurements Built an automated timing framework Measured the time to load the initial page and Measured the time to download the latest list of kittens from Flickr 9

Evaluation: Gadget Aggregator Measurements Application Simple gadget aggregator Allows the user to customize the font color of all his or her gadgets Three gadget aggregator architectures Sandboxed Unsafe Subspace Time Measurement Used the automated timing framework Measured the setup time Measure the time it took to change the font color 10

Related Work XML access-control instruction W 3 C working draft <? access-control? >: authorization of read access to XML content JSONRequest (Java. Script Object Notation Request) Can perform cross-domain data requests Accept only data with a mime type application/json Browser. Shield preprocess the gadget’s Java. Script code to ensure that it can only perform actions within a set of acceptable guidelines Developing these policies is a challenging problem could prevent some denial-of-service Cross-document messages Proposal for a browser standard allow frames to send string messages to each other regardless of their source domain 11

Comments Motivation Spatio-Temporal Predicates 12

Questions? 13