CAJ | 학술논문

自从万维网出现以来Web应用发生了很大变化,从最初的简单静态文档发展到功能多样的动态程序。然而主流的Web防护模型仍然基于同源策略,这种安全模型在识别Web应用程序以及怎么管理它们都有很多缺陷,这导致Web程序成了最容易受到攻击的目标,尤其是其中的Web插件问题最为严重。根据Web程序特性,借鉴操作系统的安全构架原理提出一种名为Thor的浏览器安全模型,Thor主要使用系统调用干预来完成对安全策略的制定和执行,并且使得策略的执行不仅限于HTML和Javascript,而是进一步扩展到浏览器插件和浏览器扩展。最后实现一个Thor的原型系统,验证了其对浏览器的安全加强以及性能开销。
자종만유망출현이래Web응용발생료흔대변화,종최초적간단정태문당발전도공능다양적동태정서。연이주류적Web방호모형잉연기우동원책략,저충안전모형재식별Web응용정서이급즘요관리타문도유흔다결함,저도치Web정서성료최용역수도공격적목표,우기시기중적Web삽건문제최위엄중。근거Web정서특성,차감조작계통적안전구가원리제출일충명위Thor적류람기안전모형,Thor주요사용계통조용간예래완성대안전책략적제정화집행,병차사득책략적집행불부한우HTML화Javascript,이시진일보확전도류람기삽건화류람기확전。최후실현일개Thor적원형계통,험증료기대류람기적안전가강이급성능개소。
Web Applications have changed significantly since the introduction of World Wide Web,with a shift from simple hyperlinked documents to active programs in Web content. However,the prevailing web protection model,based on same origin policy,is still an imperfect approach to identifying web applications and governing their behaviors. As a result,web applications have become attractive targets of exploitation,particularly web plug-ins. In this paper,Thor,a new web browser security model is proposed,which adopts lessons from OS to make the browser a more suitable platform for web applications. By using system call interposition,Thor is responsible for uniformly specifying and implementation security policies not just on HTML and JavaScript,but further on plug-in media and browser extensions. The implementation of a Thor prototype is described,and how browsers to use Thor for securing their resources discussed.