Isolating web programs in modern browser architectures

ABSTRACT

Many of today's web sites contain substantial amounts of client-side code, and consequently, they act more like programs than simple documents. This creates robustness and performance challenges for web browsers. To give users a robust and responsive platform, the browser must identify program boundaries and provide isolation between them.

We provide three contributions in this paper. First, we present abstractions of web programs and program instances, and we show that these abstractions clarify how browser components interact and how appropriate program boundaries can be identified. Second, we identify backwards compatibility tradeoffs that constrain how web content can be divided into programs without disrupting existing web sites. Third, we present a multi-process browser architecture that isolates these web program instances from each other, improving fault tolerance, resource management, and performance. We discuss how this architecture is implemented in Google Chrome, and we provide a quantitative performance evaluation examining its benefits and costs.

REFERENCES

• 1: Alexa. Alexa Web Search -- Top 500. http://www.alexa.com/site/ds/top_500, 2008.
• 2: Adam Barth, Collin Jackson, Charles Reis, and Google Chrome Team. The Security Architecture of the Chromium Browser. Technical report, Stanford University, 2008. http://crypto.stanford.edu/websec/chromium/chromium-security-architecture.pdf.
• 3: Richard S. Cox , Steven D. Gribble , Henry M. Levy , Jacob Gorm Hansen, A Safety-Oriented Platform for Web Applications, Proceedings of the 2006 IEEE Symposium on Security and Privacy, p.350-364, May 21-24, 2006 [doi>10.1109/SP.2006.4]
• 4: Todd Ditchendorf. Fluid -- Free Site Specific Browser for Mac OS X Leopard. http://fluidapp.com/, 2008.
• 5: Google. Issue 3666 -- chromium -- Tab crash (sad tab, aw snap) on jquery slidetoggle with-webkit-column-count greater than 1 -- Google Code. http://code.google.com/p/chromium/issues/detail?id=3666, October 2008.
• 6: Google. Memory Usage Backgrounder (Chromium Developer Documentation). http://dev.chromium.org/memory-usage-backgrounder, 2008.
• 7: Google. Plugin Architecture (Chromium Developer Documentation). http://dev.chromium.org/developers/design-documents/plugin-architecture, 2008.
• 8: Google. Process Models (Chromium Developer Documentation). http://dev.chromium.org/developers/design-documents/process-models, 2008.
• 9: Chris Grier , Shuo Tang , Samuel T. King, Secure Web Browsing with the OP Web Browser, Proceedings of the 2008 IEEE Symposium on Security and Privacy, p.402-416, May 18-21, 2008 [doi>10.1109/SP.2008.19]
• 10: Norm Hardy, The Confused Deputy: (or why capabilities might have been invented), ACM SIGOPS Operating Systems Review, v.22 n.4, p.36-38, Oct. 1988
• 11: Ian Hickson and David Hyatt. HTML 5. http://www.w3.org/html/wg/html5/, October 2008.
• 12: Sotiris Ioannidis , Steven M. Bellovin, Building a Secure Web Browser, Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference, p.127-134, June 25-30, 2001
• 13: Mozilla. Public Suffix List. http://publicsuffix.org/, 2007.
• 14: Mozilla. Prism. https://developer.mozilla.org/en/Prism, 2008.
• 15: Stuart Parmenter. Firefox 3 Memory Usage. http://blog.pavlov.net/2008/03/11/firefox-3-memory-usage/, March 2008.
• 16: Charles Reis, Brian Bershad, Steven D. Gribble, and Henry M. Levy. Using Processes to Improve the Reliability of Browser-based Applications. Technical Report UW-CSE-2007-12-01, University of Washington, December 2007.
• 17: Charles Reis, Steven D. Gribble, and Henry M. Levy. Architectural Principals for Safe Web Programs. In HotNets-VI, November 2007.
• 18: Jesse Ruderman. The Same Origin Policy. http://www.mozilla.org/projects/security/components/same-origin.html, 2001.
• 19: Peter Watkins. Cross-Site Request Forgeries. http://www.tux.org/~peterw/csrf.txt, 2001.
• 20: Andy Zeigler. IE8 and Loosely-Coupled IE. http://blogs.msdn.com/ie/archive/2008/03/11/ie8-and-loosely-coupled-ie-lcie.aspx, March 2008.
• 21: Andy Zeigler. IE8 and Reliability. http://blogs.msdn.com/ie/archive/2008/07/28/ie8-and-reliability.aspx, July 2008.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
        D.2.11 Software Architectures
            Subjects: Domain-specific architectures

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.5 Reliability
          Subjects: Fault-tolerance

  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications
          Subjects: Information browsers

General Terms:
Design, Experimentation, Performance, Reliability

Keywords:
isolation, multi-process browser, reliability, robustness, web browser architecture