Controlling Cookies A policy language for fine grained decisions Brian Hackbarth Example Problem You are operating in a federated domain that uses cookies for authentication You must accept third party cookies for the 50 or more sites within the domain but you don t want to accept generic third party cookies from sites you don t trust How do you do this Current Browser Options Possible solutions Accept all third party cookies Construct deny accept filters forces you to accept third party cookies with 50 sites this is very painful We need a way to specify fine grained preferences Policy Language Allows for detailed construction of policy rules Scales well between simple polices and complex policies Desired Properties Powerful Simple want to be able to express arbitrary policies can t be overly complex to use otherwise mistakes become easier to make when specifying policy Easy to specify should be able to translate well into GUI specification or some other means Properties cont System Independence policies need to be able to be transferred to other systems with minimal work Subsume current standard along with expressive power the language needs to be able to provide the functionality describe by the standard RFC 2965 Overview XML based XML is becoming THE industry standard for everything web meta language so can be used on any platform Plug in architecture engine plug ins can easily be integrated into the policy engine to increase flexibility Example Disable all cookies both sending and receiving CookiePolicy name disable all PolicyItem PolicyType SendPolicy PolicyType PolicyType StorePolicy PolicyType PolicyRule accept all PolicyRule PolicyItem CookiePolicy Extending Policies MatchElement elements specify plug in rules the policy engine enforces Allows arbitrary policies to be enforced given the appropriate engine code Policies are system independent enforcement engine determines if plug in exists how to handle decision plug ins deliver Example Plug ins Digital signature matching Organization matching in different domains P3P only websites Infinite possibilities Future Work Enforcement engine implement in open source browser Additional plug ins for core library provide a robust initial plug in library that encompasses normal usage
View Full Document
Unlocking...