Nataliia Bielova

Researcher (CR1)
INDES team, Inria Sophia Antipolis
2004 route des Lucioles
B.P. 93 - 06902 Sophia Antipolis cedex
Tel: +33 (0)4 92 38 77 87
Office F129
Firefox Chrome

nataliia.bielova (at) inria.fr

Web browser fingerprinting analysis and protection mechanisms

Third-party tracking on the web has gathered much attention but there are few studies that discuss the technologies behind these complicated mechanisms. These techniques are into stateful and stateless. Stateful techniques are storing identifying information in the user's browser (e.g., in cookies), while stateless techniques are able to identify the user from accessing different browser and operating system properties. Stateless technologies are often called "device fingerprinting".

We propose a novel approach to hybrid information flow monitoring by tracking the knowledge about the user web browser using logical formulae. We define a generic hybrid monitor parametrised by a static analysis and derive sufficient conditions on the static analysis for soundness and relative precision of hybrid monitors.

We then proposed a randomisation technique that helps the users to randomise their browser fingerprints in order to have a provable guarantee of privacy - a guarantee that the probability of being identified is bounded by a certain threshold.

Publications

JavaScript security by runtime monitors and information flow control

In this survey we compare the security enforcement mechanisms developed for JavaScript security and implemented in web browsers. First, we analyse browser security-relevant APIs, and identify useful security policies for JavaScript. Second, we group the existing enforcement mechanisms in two groups: dynamic mechanisms based on runtime monitoring and information flow control techniques. For each mechanism we define a class of security policies it enforces, formal guarantees it provides and compare its implementation strategy.

This survey targets two groups of readers: 1) for computer security researchers we propose an overview of security-relevant components of the web browser and the security policies based on these components, we also show how well-known enforcement techniques are applied in a web browser setting; 2) for web developers we propose a classification of security policies, comparison of existing enforcement mechanisms proposed in the literature and explanation of formal guarantees that they provide.

Publications

Information flow security for a web browser model

In this project we investigate the suitability of non-interference as a replacement for the baseline security policy of a browser, the same-origin-policy. We propose an enforcement mechanism based on secure multi-execution that can enforce non-interference with respect to a broad class of security level lattices for the full browser. We prove the security and precision of the enforcement mechanism, and implement it for the Featherweight Firefox browser model.

Next, we analyse the security level posets that are useful in a web context, and how inputs and outputs to the browser should be labelled. Our analysis shows that useful policies (which approximate but improve the current same-origin-policy) can be defined without any support for declassification.

Publications

Predictability of enforcement and error-toleration

We have proposed how to go beyond the (only) two classical prop- erties used to evaluate an enforcement mechanism: soundness and transparency. Soundness specifies that the output is always good and transparency guarantees that good input is not changed. However those two characteristics alone are not sucient to discriminate between enforcement mechanisms. The key issue is to specify how bad input is fixed into good output. We have introduced several notions that could describe predictable behavior and checked them against the industrial case study on e-Health. The idea behind the notion of predictability is that there are "no surprises on bad inputs".

Having introduced the notion of predictability, we propose a practical approach for enforcement error-tolerant policies. In a e-health scenario, the clinician only specifies the default policy and marks for each protocol step the venial errors and their possible corrections. Given a global bound on the amount of errors in a trace that can be tolerated for each workflow execution, we automatically generate an enforcement mechanism based on edit-automata that can provably enforce the policy with a sufficient degree of predictability. We illustrate our approach with a concrete e-health work-flow from the Italian region of Lombardy.

This work has been done within the EU-IP-MASTER project (Managing Assurance, Security and Trust for Services).

Publications

Constuctive enforcement by iterative suppression automata

Edit automata are powerful theoretical models of runtime enforcement mechanisms, but they have never been applied in practice because an automatic edit automaton construction from a given security policy has not been devised. While collaborating with Hospital San Raffaele of Milan, which is one of the most renowned Italian hospitals, we used edit automata model to build an enforcement mechanism for their business process.

We then developed a specific kind of edit automaton, called iterative suppression automaton, that enforces a specific class of policies called iterative properties. We provided an automatic construction of an iterative suppression automata from a given security policy and proved its formal guarantees.

This work has been done within the EU-IP-MASTER project (Managing Assurance, Security and Trust for Services).

Publications

Security-by-contract for mobile code security

A novel security-by-contract framework has been proposed. Its key idea is to augment mobile code with a claim on its security behavior (a contract) that could be matched against a mobile platform policy before downloading the code. Thanks to security-by-contract a digital signature does not just certify the origin of the code but rather binds together the code with a contract. The mobile device is assumed to contain a security policy that describes the desired behavior of the applications to be installed.

Publications

This work has been done within the EU-IST-STREP-S3MS project (Security and Services for Mobile Systems).