Skip to main content

Web 2.0 technologies, such as Ajax (Asynchronous JavaScript + XML) and Mashups, represent a significant shift in the Internet infrastructure technology. Web 2.0 is being widely used, not only in consumer services, but also in enterprise-level business applications. In addition, Web 2.0 is a key technology that enables Software as a Service (SaaS), which is changing the way people use software, and freeing users from the burdens of installation and maintenance, thus optimizing the IT management costs. As Web 2.0 and SaaS are being used in more business environments, security is becoming more important than ever. We are filling in some of the security gaps with research on and development of security technologies for Web 2.0 and SaaS.

Web Contents Filtering Technology

Cross-site scripting (XSS) attacks, which embed malicious JavaScript into Web content in various ways, have become one of the major attacks as Web 2.0 technology has become more popular. Although infamous XSS attacks began with Web 1.0 technologies, they are now estimated to contribute to 70 percent of the vulnerabilities in the existing Web applications and they can easily lead to serious problems. In order to protect against XSS, the generally favored approach is to filter all user input included in an HTTP request to remove any malicious JavaScript. However, it is difficult to protect against complicated XSS attacks on Web applications that use external resources, such as databases, external services, or Mashups to generate their Web content. It is also difficult to protect against XSS attacks using specialized types of Web content, such as Flash, PDF, feeds, or JSON.

TRL is working on Active Content Filtering (ACF) technology to protect clients from such XSS attacks. ACF provides mechanisms to remove or rewrite malicious JavaScript included in the various kinds of Web content generated by a Web application. Now TRL is focusing on improving the performance and accuracy of ACF processing, although there is basically a trade-off between performance and accuracy.

Web Contents Filtering Technology

Secure Mashups!! A step towards corporate mashups

Mashup applications mix and merge content (data and code) from multiple content providers in a user′s browser, providing high-value Web applications that can rival the user experience provided by desktop applications. When the first mashups started popping up on the Internet, corporate users started noticing the potential of combining different data sources into one new representation, not only for their private lives, but also to enhance their work lives.

However, current browser security models were not designed to support such applications and they are therefore implemented with insecure workarounds. This leads to potential dangers with mixtures of corporate data and third-party data without any reliable security mechanisms in place to prevent both kinds of data from accessing each other.

In our secure mashups research, we are working on a secure component model, where components are provided by different trust domains, and can interact using communication abstractions that allows easy specification of security policies. We have developed an implementation of this model that works in all of the major browsers, and that addresses such challenges as communication integrity and frame-phishing. By sandboxing third party components in a webpage, we are providing an answer to the security concerns that were preventing mashups from being widely adopted by corporations. The current results of this work were presented at WWW 2008[1].

Secure Mashup Technology

Content-Based Data Leakage Prevention Technology

The emergence of Software as a Service (SaaS) has changed the way people use software. Instead of purchasing packaged software and installing it on their own computing platforms, people now use applications hosted on servers of third-party service providers. SaaS can free the IT department of a company from the burdens of installation, maintenance (such as version updates and security patches), backups, etc., and thus reduces the IT management costs.

However, because of the nature of SaaS, there are many security concerns that may prevent users from migrating to the SaaS environment. A SaaS environment may be shared not only between multiple organizations within a company, but may also allow collaboration across corporate boundaries. On the one hand, such collaborative SaaS environments introduce additional concerns regarding data protection. On the other hand, such an SaaS environment offers companies an opportunity to centralize the data management, even across corporate borders. It is well known that the majority of sensitive information in an enterprise is within individual PCs, especially due to the prevalence of office documents. However, by migrating to a SaaS environment, employees no longer need to keep data on their HDDs, which makes data governance an easier task.

Our technology addresses the threats of data leakage in collaborative SaaS environments, especially in the context of document security. The Content-Based Data Leakage Prevention technology detects potentially confidential documents by validating their contents and protects them from unauthorized disclosures.

Data Leakage Prevention Technology

Web Application Vulnerability Detection Technology

We are studying theoretical aspects of Web applications and developing technologies to detect security flaws and to verify the safety of Web applications based on these theories.

In particular, we are focusing on program analysis techniques such as static information flow analyses, static string analyses, and combinations of static and dynamic analyses.

With information flow analysis, we can verify confidentiality and integrity for server-side and client-side applications. For a server-side application, we address how to check the integrity of the applications. For client-side applications, we are trying to formalize the behaviors of a Web browser as a basis for studying techniques to protect the Web browser from attacks such as cross-site scripting (XSS) [2].

In addition, we are also interested in string analysis and its applications [3], since a lot of the security flaws Web applications are caused by illegal strings input by the users of the application. Our string analysis forms a family of static program analyses that can statically determine the possible strings that can appear at runtime.