1. A UTOMATICALLY SECURING WEB 2.0 APPLICATIONS THROUGH REPLICATED EXECUTION Ben Livshits Microsoft Research

2. Web 2.0 is Upon Us 2

3. JavaScript + DHTML Client-side computation Server-side computation Client-side rendering Static HTML Web 1.0 → Web 2.0 3

4. M OTIVATION & P ROJECT G OALS

5. Motivation Microsoft Company Store 5

6. Motivation Distributed Computing on a Planetary Scale Nepal 6

7. Motivation Web Developer’s Mantra Thou shall not trust the client No data integrity No code integrity 7

8. Motivation Tension Headaches 8 Move code to the server for security Move code to client for performance

9. Motivation Security vs. Performance 9 responsiveness security Web 1.0: ASP.NET PHP Web 2.0: AJAX Silverlight Ripley With Ripley, placing computation on the client does not reduce computational integrity

10. A RCHITECTURE

11. Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Server Replica Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e 11

12. Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Client Client-side code instrumented Rewrite event handlers Capture “default” events Buffer events for performance Server Replica button.onClick = function buttonHandler(e) { var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; }; button.onClick = function buttonHandler(e) { ripleyEnqueue(e); // inserted by rewriting var obj = eventTrigger(e); var notify = document.getElementById && document.getElementById('notify'); notify.value = 'You clicked on ' + obj.value; return true; }; 12

13. Algorithms Ripley Architecture 1.Keep a replica of the client code 2.Capture user events & transmit to server for replay 3.Compare server and client results Client Ripley checker events = {key: ‘a’, id=‘name’; click: id=‘name’} m' m e Server Replica Run replica in a Ripley emulator Run in.NET, not in JavaScript, 100x speed increase 13

14. Algorithms Implementation Details Client: Run as part of tier-splitting – Rewrite client component to capture events – Queue on the client, marshal to the server Server: Rewrite the original assembly – Catch events on the server, de-marshal – Checker: compare m vs. m’ Client replica: – Emulator is a light-weight browser replacement – Client adapted to run within the emulator 14

15. Algorithms Eager vs. Lazy Transfer 15

16. E XPERIMENTAL R ESULTS

17. Experiments Ripley Applications Shopping cart Sudoku Blog Speed typing Online Quiz Distributed online game 17

18. Experiments Performance Overhead Summary 18

19. Experiments Network Overhead 19

20. Experiments Client and Server Overhead 20

21. Experiments Memory Overhead 21

22. Conclusions 1.Strong protection: – Automatic protection of distributed web apps – Provides strong integrity guarantees 2.Easy for developer: – No developer involvement required – Protects existing Volta apps out-of-the-box 22

23. Ripley: Vision for the Future Secure-by-construction Software + Services 23 Ripley server farm Web 2.0 App

24. Contact us Ben Livshits (livshits@microsoft.com)livshits@microsoft.com Microsoft Research Ripley project 24