![](bg6.png)
5.2.2 Code Integrity
Before the application code itself is executed, it needs
to be checked for its integrity and this can be trivially
done using the already established session key and
verifying the MAC and nonce computed on the client
with the ones sent by the webserver.
5.2.3 Data Integrity
During execution, the Web application might request
data from the webserver. Our approach is to, during
the code transformation phase, scan all calls that
result in these data exchanges (such as calls to
XMLHttpRequest() in JavaScript) and inject the logic
necessary to perform integrity checks on these data
(i.e. generate and verify the MACs and nonces). In
this way, we can also guarantee the integrity of the
data at the Web application being executed under the
code protection mechanism.
6 CONCLUSION
We have presented a framework, inspired by existing
building blocks, which delineates a possible future for
Web application integrity protection. Our framework
relies heavily on an obfuscation-based code
protection mechanism, which enforces a trust
boundary inside the browser. In this work, we focus
on outlining this complete Web Application integrity
framework.
As discussed, WoT applications are set to become
omnipresent, and our framework becomes even more
relevant under this assumption. Supporting different
types of devices (interoperability), with different
capabilities is one important aspect to be addressed
by our implementation. We note however that there
are already very capable platforms for WoT
applications (Sin and Shin, 2016). Proof-of-concept
implementation and performance evaluation (e.g.
evaluating overhead introduced by our code
transformations) of our proposed framework are left
as a future work.
REFERENCES
Atzori, L., Iera, A., and Morabito, G. (2010). The internet
of things: A survey. Computer networks, 54(15), 2787-
2805.
Borgolte, K., Kruegel, C., and Vigna, G. (2013). Delta:
Automatic Identification of Unknown Web-based
Infection Campaigns. In Proceedings of the 2013
ACM SIGSAC Conference on Computer and#38;
Communications Security (pp. 109–120). New York,
NY, USA: ACM. https://doi.org/10.1145/2508859.
2516725
Chang, H., Atalla, M. J. (2001). Protecting Software Code
by Guards. ACM Workshop on Digital Rights
Management.
Chow, S., Eisen, P., Johnson, H., and Van Oorschot, P. C.
(2002, August). White-box cryptography and an AES
implementation. In International Workshop on Selected
Areas in Cryptography (pp. 250-270). Springer Berlin
Heidelberg.
Collberg, C. S., and Thomborson, C. (2002). Watermark-
ing, Tamper-proofing, and Obfuscation: Tools for
Software Protection. IEEE Trans. Softw. Eng., 28(8),
735–746. https://doi.org/10.1109/TSE.2002.1027797
Cox, B., Evans, D., Filipi, A., Rowanhill, J., Hu, W.,
Davidson, J., … Hiser, J. (2006). N-variant Systems: A
Secretless Framework for Security Through Diversity.
In Proceedings of the 15th Conference on USENIX
Security Symposium - Volume 15. Berkeley, CA, USA:
USENIX Association.
Cylon.js. (2017, October). Retrieved from
https://cylonjs.com/
Diffie, W., Van Oorschot, P. C., and Wiener, M. J. (1992).
Authentication and authenticated key exchanges.
Designs, Codes and cryptography, 2(2), 107-125.
Garg, S., Gentry, C., Halevi, S., Raykova, M., Sahai, A.,
and Waters, B. (2013, October). Candidate indistingui-
shability obfuscation and functional encryption for all
circuits. In Foundations of Computer Science (FOCS),
2013 IEEE 54th Annual Symposium on (pp. 40-49).
Göktas, E., Athanasopoulos, E., Bos, H., and Portokalidis,
G. (2014). Out of control: Overcoming control-flow
integrity. In 2014 IEEE Symposium on Security and
Privacy (pp. 575–589). IEEE.
Gupta, S. and Gupta, B. B., 2017. Cross-Site Scripting
(XSS) attacks and defense mechanisms: classification
and state-of-the-art. International Journal of System
Assurance Engineering and Management, 8(1), pp.512-
530.
Hallgren, P. A., Mauritzson, D. T., and Sabelfeld, A.
(2013). GlassTube: A Lightweight Approach to Web
Application Integrity. In Proceedings of the Eighth
ACM SIGPLAN Workshop on Programming
Languages and Analysis for Security (pp. 71–82).
Huang, Y., Stavrou, A., Ghosh, A. K., and Jajodia, S.
(2008). Efficiently Tracking Application Interactions
Using Lightweight Virtualization. In Proceedings of the
1st ACM Workshop on Virtual Machine Security (pp.
19–28). New York, NY, USA: ACM. https://doi.org/
10.1145/1456482.1456486
IoT.js. (2017, October). Retrieved from http://iotjs.net/
Kapravelos, A., Grier, C., Chachra, N., Kruegel, C., Vigna,
G., and Paxson, V. (2014). Hulk: Eliciting Malicious
Behavior in Browser Extensions. In Proceedings of the
23rd USENIX Conference on Security Symposium (pp.
641–654). Berkeley, CA, USA: USENIX Association.
Retrieved from http://dl.acm.org/citation.cfm?id=267
1225.2671266
ICISSP 2018 - 4th International Conference on Information Systems Security and Privacy
492