New internet security system to revolutionise user privacy

Researchers have developed a new system that protects Internet users' privacy whilst increasing the flexibility for web developers to build web applications that combine data from different web sites,

Researchers have developed a new system that protects Internet users' privacy while increasing the flexibility for web developers to build applications that combine data from different sites, thus dramatically improving the safety of surfing the internet.

According to the researchers at UCL, Stanford Engineering, Google, Chalmers and Mozilla Research, the system, named Confinement with Origin Web Labels (COWL), works with Mozilla's Firefox and the open-source version of Google's Chrome web browsers and prevents malicious code in a web site from leaking sensitive information to unauthorized parties.

The system also allows code in a web site to display content drawn from multiple web sites - an essential function for modern, feature-rich web applications.

The researchers show that the system provides strong security without perceptibly slowing the loading speed of web pages and will be freely available for download and use on October 15 at http://cowl.ws.

Co-author Professor Brad Karp (UCL Computer Science), said that COWL achieves both privacy for the user and flexibility for the web application developer. Achieving both these aims, which are often in opposition in many system designs, is one of the central challenges in computer systems security research.

Karp said that the new system provides a property known as 'confinement' which has been known since the 1970s, but proven difficult to achieve in practical systems like web browsers. COWL confines JavaScript programs that run within the browser, such as in separate tabs. If a JavaScript program embedded within one web site reads information provided by another web site - legitimately or otherwise - COWL permits the data to be shared, but thereafter restricts the application receiving the information from communicating it to unauthorized parties. As a result, the site that shares data maintains control over it, even after sharing the information within the browser.