Ripley: automatically securing web 2.0 applications through replicated execution

Rich Internet applications are becoming increasingly distributed, as demonstrated by the popularity of AJAX or Web 2.0 applications such as Facebook, Google Maps, Hotmail and many others. A typical multi-tier AJAX application consists, at the least, of a serverside component implemented in Java J2EE, PHP or ASP.NET and a client-side component running JavaScript. The resulting application is more responsive because computation has moved closer to the client, avoiding unnecessary network round trips for frequent user actions. However, once a portion of the code has moved to the client, a malicious user can subvert the client side of the computation, jeopardizing the integrity of the server-side state. In this paper we propose RIPLEY, a system that uses replicated execution to automatically preserve the integrity of a distributed computation. RIPLEY replicates a copy of the client-side computation on the trusted server tier. Every client-side event is transferred to the replica of the cl...

• Type: Conference
• Year: 2009
• Where: CCS
• Authors: K. Vikram, Abhishek Prateek, V. Benjamin Livshits
• Keywords: Ajax Application, CCS 2009, Client-side, Multi-tier Ajax Application, Security Privacy