Verena: End-to-End Integrity Protection for Web Applications

摘要: Web applications rely on web servers to protect the integrity of sensitive information. However, an attacker gaining access can tamper with data and query computation results, thus serve corrupted pages user. Violating page have serious consequences, affecting application functionality decision-making processes. Worse yet, violation may affect physical safety, as in case medical which enable physicians assign treatment patients based diagnostic information stored at server. This paper presents Verena, a platform that provides end-to-end guarantees against attackers full database servers. In client's browser verify by verifying results queries Verena strong properties such freshness, completeness, correctness for common set queries, relying small trusted computing base. setting where there be many users different write permissions, allows developer specify policy our notion trust contexts, then enforces this efficiently. We implemented evaluated top Meteor framework. Our show support real modest overhead.