Using replicated execution for a more secure and reliable web browser.
Hui Xue, Nathan Dautenhahn, Samuel Talmadge King · Network and Distributed System Security Symposium · 2012
Modern web browsers are complex. They provide a high-performance and rich computational environment for web-based applications, but they are prone to numerous types of security vulnerabilities that attackers actively exploit. However, because major browser platforms differ in their implementations they rarely exhibit the same vulnerabilities. In this paper we present Cocktail, a system that uses three different off-the-shelf web browsers in parallel to provide replicated execution for withstanding browserbased attacks and improving browser reliability. Cocktail mirrors inputs to each replica and votes on browser states and outputs to detect potential attacks, while continuing to run. The net effect of Cocktail’s architecture is to shift the security burden of the system from complex browsers to a simplified layer of software. We demonstrate that Cocktail can withstand real-world browser exploits and reliability issues, such as browser crashes, while adding only 31.5% overhead to page load latency times on average, and remaining compatible with popular web sites.