A UTOMATICALLY SECURING WEB 2.0 APPLICATIONS THROUGH REPLICATED EXECUTION Ben Livshits Microsoft Research

Web 2.0 is Upon Us 2

JavaScript + DHTML Client-side computation Server-side computation Client-side rendering Static HTML Web 1.0 → Web 2.0 3

M OTIVATION & P ROJECT G OALS

Motivation Microsoft Company Store 5

Motivation Distributed Computing on a Planetary Scale Nepal 6

Motivation Web Developer’s Mantra Thou shall not trust the client No data integrity No code integrity 7

Motivation Tension Headaches 8 Move code to the server for security Move code to client for performance

Motivation Security vs. Performance 9 responsiveness security Web 1.0: ASP.NET PHP Web 2.0: AJAX Silverlight Ripley With Ripley, placing computation on the client does not reduce computational integrity

A RCHITECTURE

Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Server Replica Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e 11

Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Client Client-side code instrumented Rewrite event handlers Capture “default” events Buffer events for performance Server Replica button.onClick = function buttonHandler(e) { var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; }; button.onClick = function buttonHandler(e) { ripleyEnqueue(e); // inserted by rewriting var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; }; 12

Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Server Replica Run replica in a Ripley emulator Run in.NET, not in JavaScript, 100x speed increase 13

Algorithms Implementation Details Client: Run as part of tier-splitting – Rewrite client component to capture events – Queue on the client, marshal to the server Server: Rewrite the original assembly – Catch events on the server, de-marshal – Checker: compare m vs. m’ Client replica: – Emulator is a light-weight browser replacement – Client adapted to run within the emulator 14

Algorithms Eager vs. Lazy Transfer 15

E XPERIMENTAL R ESULTS

Experiments Ripley Applications Shopping cart Sudoku Blog Speed typing Online Quiz Distributed online game 17

Experiments Performance Overhead Summary 18

Experiments Network Overhead 19

Experiments Client and Server Overhead 20

Experiments Memory Overhead 21

Conclusions 1.Strong protection: – Automatic protection of distributed web apps – Provides strong integrity guarantees 2.Easy for developer: – No developer involvement required – Protects existing Volta apps out-of-the-box 22

Ripley: Vision for the Future Secure-by-construction Software + Services 23 Ripley server farm Web 2.0 App

Contact us Ben Livshits Microsoft Research Ripley project 24