1 / 127

Secure Distributed Programming with Object-capabilities in JavaScript

Secure Distributed Programming with Object-capabilities in JavaScript. Mark S. Miller and the Cajadores. Overview. Why object-capability (ocap) security? Local ocap security in JavaScript Flexible secure mobile code Distributed crypto-caps in JavaScript

abie
Download Presentation

Secure Distributed Programming with Object-capabilities in JavaScript

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Secure Distributed Programming with Object-capabilities in JavaScript Mark S. Miller and the Cajadores

  2. Overview Why object-capability (ocap) security? Local ocap security in JavaScript Flexible secure mobile code Distributed crypto-caps in JavaScript Secure distributed object programming

  3. Early Choice. Late Despair • ACLs and OCaps start in mid ‘60s. • ACLs: “Who is making this request?” • OCaps: “Is this request authorized?” • ‘70s: Industry took ACL fork in road. • ‘90s to present: Rise of Malware

  4. A Very Powerful Program

  5. This program can delete any file you can. A Very Powerful Program

  6. Original Web Link/Form GET/POST Frame Server New Page Browser Link/Form GET/POST Frame Server New Page

  7. Ajax = Mobile code + async msgs XHR GET/POST Frame Server XHR Response Browser Web services XHR GET/POST Frame Server XHR Response

  8. Kludging Towards Distributed Objects XHR GET/POST Frame Server XHR Response, Comet Fragment tricks Browser JSONP Web services XHR GET/POST Frame Server XHR Response, Comet

  9. A Web of Distributed Objects XHR GET/POST Frame Server XHR Response, SSE postMessage Cross-Origin XHR with UMP Browser Web services XHR GET/POST Frame Server XHR Response, SSE

  10. A Web of Distributed Objects Mobile messages, code, objects, references

  11. A Web of Distributed Objects

  12. A Web of Distributed Objects

  13. A Web of Distributed Objects

  14. A Very Powerful Email Message

  15. A Very Powerful Email Message <html> <head> <title>Basic Mashup</title> <script> function animate(id) { var element = document.getElementById(id); var textNode = element.childNodes[0]; var text = textNode.data; var reverse = false; element.onclick = function() { reverse = !reverse; }; setInterval(function() { textNode.data = text = reverse ? text.substring(1) + text[0] : text[text.length-1] + text.substring(0, text.length-1); }, 100); } </script> </head> <body onload="animate('target')"> <pre id="target">Hello Programmable World! </pre> </body> </html>

  16. Active Content: Mobile Code as Media <html> <head> <title>Basic Mashup</title> <script> function animate(id) { var element = document.getElementById(id); var textNode = element.childNodes[0]; var text = textNode.data; var reverse = false; element.onclick = function() { reverse = !reverse; }; setInterval(function() { textNode.data = text = reverse ? text.substring(1) + text[0] : text[text.length-1] + text.substring(0, text.length-1); }, 100); } </script> </head> <body onload="animate('target')"> <pre id="target">Hello Programmable World! </pre> </body> </html>

  17. The Road Not Taken ?

  18. The Road Not Taken ?

  19. The Road Not Taken ?

  20. The Road Not Taken ? ?

  21. Security as Extreme Modularity • Modularity: Avoid needless dependencies • Security: Avoid needless vulnerabilities • Vulnerability is a form of dependency • Modularity: • Principle of info hiding - need to know • Security: • Principle of least authority - need to do

  22. … Introduction ref to Carol ref to Bob decides to share … Parenthood … Endowment … Initial Conditions Connectivity by… Alice says: bob.foo(carol) How might object Bob come to know object Carol?

  23. OCaps: Small step from pure objects Memory safety and encapsulation + Effects only by using held references + No powerful references by default

  24. OCaps: Small step from pure objects Memory safety and encapsulation + Effects only by using held references + No powerful references by default Reference graph ≡ Access graph • Only connectivity begets connectivity • Natural Least Authority OO expressiveness for security patterns

  25. Objects as Closures in JavaScript makeCounter incr incr incr count count count decr decr decr function makeCounter() { var count = 0; return { incr: function() { return ++count; }, decr: function() { return --count; } }; }

  26. Objects as Closures in JavaScript makeCounter incr incr incr count count count decr decr decr A record of closures hiding state is a fine representation of an object of methods hiding instance vars function makeCounter() { var count = 0; return { incr: function() { return ++count; }, decr: function() { return --count; } }; }

  27. Objects as Closures in EcmaScript 3 makeCounter incr incr incr count count count decr decr decr • function makeCounter() { • var count = 0; • return { • incr: function() { return ++count; }, • decr: function() { return --count; } • }; } • Scoping confusions • Encapsulation leaks • Pervasive mutability

  28. Defensive Objects in SES on ES5 makeCounter incr incr incr count count count decr decr decr A tamper-proof record oflexical closures encapsulating state is a defensive object “use strict”; function makeCounter() { var count = 0; return def({ incr: function() { return ++count; }, decr: function() { return --count; } }); }

  29. Turning EcmaScript 5 into SES • <script src=“initSES.js”></script> • Monkey patch away bad non-std behaviors • Remove non-whitelisted primordials • Install leaky WeakMap emulation • Make virtual global root • Freeze whitelisted global variables • Replace eval & Function with safe alternatives • Freeze accessible primordials

  30. No powerful references by default Alice Bob bob Carol carol Alice says: var bobSrc = //site B var carolSrc = //site C var bob = eval(bobSrc); var carol = eval(carolSrc);

  31. No powerful references by default Alice says: var bobSrc = //site B var carolSrc = //site C var bob = eval(bobSrc); var carol = eval(carolSrc); Alice Bob bob Carol carol Bob and Carol are confined. Only Alice controls how they can interact or get more connected.

  32. No powerful references by default bob Alice Bob carol Carol Alice says:

  33. Only connectivity begets connectivity bob Bob counter incr carol count count Carol count decr Alice says: var counter = makeCounter(); bob(counter.incr); carol(counter.decr); bob = carol = null;

  34. Only connectivity begets connectivity bob Bob counter incr carol count count Carol count decr Bob can only count up and see result. Carol only down. Alice can only do both. Alice says: var counter = makeCounter(); bob(counter.incr); carol(counter.decr); bob = carol = null;

  35. Only connectivity begets connectivity bob Bob counter incr carol count count Carol count decr Express policy by the behavior of the objects you provide. Alice says: var counter = makeCounter(); bob(counter.incr); carol(counter.decr); bob = carol = null;

  36. Dr. SESDistributed Resilient Secure EcmaScript • Linguistic abstraction for safe messaging • Stretch reference graph between event loops & machines • Crypto analog of memory safety • SES + Promise library + infix “!” syntax • (“Q” Library usable today without “!” syntax)

  37. Unguessable URLs as Crypto-Caps https://www.example.com/app/#mhbqcmmva5ja3 How are secrets like object references?

  38. Dr. SESDistributed Resilient Secure EcmaScript

  39. Dr. SESDistributed Resilient Secure EcmaScript

  40. Dr. SESDistributed Resilient Secure EcmaScript

  41. Dr. SESDistributed Resilient Secure EcmaScript

  42. Dr. SESDistributed Resilient Secure EcmaScript

  43. Async object ops as JSON/REST ops

  44. $0 Distributed Secure Currency varpaymentP= myPurse ! makePurse(); paymentP ! deposit(10, myPurse); vargoodP= bobP ! buy(desc, paymentP); return Q(paymentP).when(function(p) { return Q(myPurse ! deposit(10, p)).when(function(_) { return good; }, … buy $10 $100 $200 $90

  45. Money as “factorial” of secure coding No explicit crypto function makeMint() { var amp = WeakMap(); • return function mint(balance) { • var purse = def({ • getBalance:function() { return balance; }, • makePurse:function() { return mint(0); }, • deposit:function(amount, src) { • Nat(balance + amount); amp.get(src)(Nat(amount)); balance += amount; } }); • function decr(amount) { balance = Nat(balance – amount); } amp.set(purse, decr); • return purse; } } Alice Bob buy makeMint mint mint purse decr purse decr purse decr amp balance

  46. Causeway Distributed Debugger Sourcilloscope

  47. Causeway Distributed Debugger Causality Grid

More Related