SafeWeb: A Middleware for Securing Ruby-Based Web Applications

Abstract

Abstract. Web applications in many domains such as healthcare and finance must process sensitive data, while complying with legal policies regarding the release of different classes of data to different parties. Currently, software bugs may lead to irreversible disclosure of confidential data in multi-tier web applications. An open challenge is how developers can guarantee these web applications only ever release sensitive data to authorised users without costly, recurring security audits.Our solution is to provide a trusted middleware that acts as a "safety net" to event-based enterprise web applications by preventing harmful data disclosure before it happens. We describe the design and implementation of SafeWeb, a Ruby-based middleware that associates data with security labels and transparently tracks their propagation at different granularities across a multi-tier web architecture with storage and complex event processing. For efficiency, maintainability and ease-of-use, SafeWeb exploits the dynamic features of the Ruby programming language to achieve label propagation and data flow enforcement. We evaluate SafeWeb by reporting our experience of implementing a web-based cancer treatment application and deploying it as part of the UK National Health Service (NHS).

FlowR

“…Our tests measure the performance of our solution, FlowR, compared with an equivalent solution, that extends native Ruby with RubyTrack, developed for the SafeWeb project [17]. It is important to note the feature differences that explain the performance difference of FlowR when compared with RubyTrack, as illustrated in table 3.…”

“…For all other uses, contact the owner/author(s). Track, a taint-tracking system for Ruby, developed by the SafeWeb project [17].…”

Information Flow Control for Secure Cloud Computing

“…Taint tracking became of interest to the research community through its use to prevent cross-site scripting or SQLinjection [54]- [59] or to detect suspicious information flows in applications [60]- [66]. When such a flow is detected, the system could either generate a report, perform automatic data sanitisation or terminate the execution depending on the purpose of the application concerned.…”

NodeSentry

“…Hosek et al, [21] developed a Ruby-based middleware that (1) associates security labels with data and (2) performs transparent label tracking, across a multi-tier web architecture in order to prevent harmful data disclosure.…”