Devdatta Akhawe

EECS Department, University of California, Berkeley

Technical Report No. UCB/EECS-2014-56

May 7, 2014

http://www2.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-56.pdf

Rich client-side applications written in HTML5 proliferate diverse platforms such as mobile devices, commodity PCs, and the web platform. These client-side HTML5 applications are increasingly accessing sensitive data, including users' personal and social data, sensor data, and capability-bearing tokens. Instead of the classic client/server model of web applications, modern HTML5 applications are complex client-side applications that may call some web services, and run with ambient privileges to access sensitive data or sensors. The goal of this work is to enable the creation of higher-assurance HTML5 applications. We propose two major directions: first, we present the use of formal methods to analyze web protocols for errors. Second, we use existing primitives to enable practical privilege separation for HTML5 applications. We also propose a new primitive for complete mediation of HTML5 applications. Our proposed designs considerably ease analysis and improve auditability.

Advisors: Dawn Song

---

BibTeX citation:

@phdthesis{Akhawe:EECS-2014-56,
    Author= {Akhawe, Devdatta},
    Title= {Towards High Assurance HTML5 Applications},
    School= {EECS Department, University of California, Berkeley},
    Year= {2014},
    Month= {May},
    Url= {http://www2.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-56.html},
    Number= {UCB/EECS-2014-56},
    Abstract= {Rich client-side applications written in HTML5 proliferate diverse platforms
such as mobile devices, commodity PCs, and the web platform.  These client-side
HTML5 applications are increasingly accessing sensitive data, including users'
personal and social data, sensor data, and capability-bearing tokens. Instead of
the classic client/server model of web applications, modern HTML5 applications
are complex client-side applications that may call some web services, and run
with ambient privileges to access sensitive data or sensors. The goal of this
work is to enable the creation of higher-assurance HTML5 applications. We
propose two major directions: first, we present the use of formal methods to
analyze web protocols for errors. Second, we use existing primitives to enable
practical privilege separation for HTML5 applications. We also propose a new
primitive for complete mediation of HTML5 applications.  Our proposed designs
considerably ease analysis and improve auditability.},
}

EndNote citation:

%0 Thesis
%A Akhawe, Devdatta 
%T Towards High Assurance HTML5 Applications
%I EECS Department, University of California, Berkeley
%D 2014
%8 May 7
%@ UCB/EECS-2014-56
%U http://www2.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-56.html
%F Akhawe:EECS-2014-56