Sessions on the web are fragile. They have been attacked successfully in many ways, by network-level attacks, by direct attacks on session cookies (the main mechanism for implementing the session concept) and by application-level attacks where the integrity of sessions is violated by means of cross-site request forgery or malicious script inclusion. This paper defines a variant of non-interference-the classical security notion from information flow security-that can be used to formally define the notion of client-side application-level web session integrity. The paper also develops and proves correct an enforcement mechanism. Combined with state-of-the-art countermeasures for network-level and cookie-level attacks, this enforcement mechanism gives very strong assurance about the client-side preservation of session integrity for authenticated sessions.
|Titolo:||Client Side Web Session Integrity as a Non-Interference Property|
|Data di pubblicazione:||2014|
|Appare nelle tipologie:||4.1 Articolo in Atti di convegno|
File in questo prodotto:
|iciss14.pdf||Documento in Pre-print||Accesso gratuito (solo visione)||Riservato|