Microsoft Research Audio 103753: Candidate Talk: End-to-end Security for Web Applications : A Language-based Approach

Most large organizations must maintain a substantial informationpresence on the world wide web in order to share information withtheir partners and customers. For instance, the United States militaryhas begun using Intellipedia, a wiki-based online document managementsystem, in order to promote information sharing between the sixteenagencies that comprise the U.S. intelligence community. Among othersecurity requirements, such an application should only allowauthorized users to access sensitive portions of a document, it shouldtrack the provenance of data in each document and it should ensurethat information releases follow a specific downgradingprotocol. Web-specific threats, like script injection attacks, mustalso be thwarted if critical data like authentication tokens are to beprotected. A framework that ensures that such a wide range of securityconcerns is correctly addressed is highly desirable but, to date, nosuch framework exists.

In this talk, I present SELinks, an extension of the Links programminglanguage in which web applications can be shown to correctly enforce awide variety of security policies end to end. In SELinks, a programmerspecifies a custom security policy by associating security labels withsensitive operations and data. SELinks prevents a policy from beingcircumvented by allowing labeled terms to be manipulated only within aseparate part of the program called the enforcement policy;application code must treat labeled values abstractly. SELinks is alsoequipped with support for policies that protect users running aspecially modified browser from script injection attacks. We have usedSELinks to build two substantial applications, including a secureonline document management system. Our initial experience indicatesthat it is relatively easy to correctly enforce many common policiesin SELinks and, using a formal model, to prove that correctenforcement entails the fulfillment of high-level security objectives.

©2008 Microsoft Corporation. All rights reserved.