@conference {718411,
	title = {SmartNIC Security Isolation in the Cloud with S-NIC},
	booktitle = {EuroSys},
	year = {2024},
	address = {Athens, Greece},
	abstract = {Modern smart NICs provide little isolation between the network functions belonging to different tenants. These NICs also do not protect network functions from the datacenter-provided management OS which runs on the smart NIC. We describe concrete attacks which allow a network function{\textquoteright}s state to leak to (or be modified by) another network function or the management OS. We then introduce S-NIC, a new hardware design for smart NICs that provides strong isolation guarantees. S-NIC pervasively virtualizes hardware accelerators, enforces single-owner semantics for each line in on-NIC cache and RAM, and provides dedicated bus bandwidth for each network function. Using this design, we eliminate side channels involving shared hardware state, and give each network function the illusion of having a private smart NIC. We show how these virtual NICs can be integrated with preexisting datacenter technologies for virtual LANs and trusted host-level computations like SGX enclaves. The overall result is that S-NIC enables strongly-isolated, NIC-accelerated datacenter applications; in these applications, network functions and host-level code receive hardware-guaranteed isolation from other applications and the datacenter provider.},
	url = {https://mickens.seas.harvard.edu/sites/scholar.harvard.edu/files/mickens/files/s-nic.pdf},
	author = {Yang Zhou and Mark Wilkening and James Mickens and Minlan Yu}
}
@conference {710751,
	title = {Holepunch: Fast, Secure File Deletion with Crash Consistency},
	booktitle = {IEEE Symposium on Security and Privacy},
	year = {2024},
	address = {San Francisco, CA},
	abstract = {
	A file system provides secure deletion if, after a file is deleted, an attacker with physical possession of the storage device cannot recover any data from the deleted file. Un- fortunately, secure deletion is not provided by commodity file systems. Even file systems which explicitly desire to provide secure deletion are challenged by the subtleties of hardware controllers on modern storage devices; those controllers obscure the mappings between logical blocks and physical blocks, silently duplicate physical blocks, and generally make it hard for host-level software to make reliable assumptions about how file data is kept on the device. State-of-the-art frameworks for secure deletion also have no crash consistency, meaning that an ill-timed power outage or software fault will desynchonize keys and the associated encrypted file data, corrupting the file system.



	In this paper, we present Holepunch, a new software-level approach for implementing secure deletion. Holepunch treats the storage device as a black box, providing secure deletion via cryptographic erasure. Holepunch uses per-file keys to transparently encrypt outgoing file writes and decrypt incoming file reads, ensuring that all physical data in the storage device is always encrypted. Holepunch uses puncturable pseudorandom functions (PPRFs) to quickly access file keys; upon the deletion of file f, Holepunch updates the PPRF so that, even if the PPRF is recovered, the PPRF cannot be used to generate f {\textquoteright}s key. By using PPRFs instead of the key trees leveraged by prior work, Holepunch reduces both the memory pressure caused by key management and the number of disk IOs needed to access files. Holepunch stores its master key in secure TPM storage, and uses a novel journaling scheme to provide crash consistency between TPM state and on-disk state.

},
	url = {https://mickens.seas.harvard.edu/sites/scholar.harvard.edu/files/mickens/files/holepunch.pdf},
	author = {Zachary Ratliff and Wittmann Goh and Abe Wieland and James Mickens and Ryan Williams}
}
@article {704241,
	title = {Create an IPCC-like body to harness benefits and combat harms of digital tech},
	journal = {Nature},
	volume = {617},
	number = {7961},
	year = {2023},
	pages = {462-464},
	url = {https://www.nature.com/articles/d41586-023-01606-9},
	author = {Joseph Bak-Coleman and Carl T. Bergstrom and Jennifer Jacquet and James Mickens and Zeynep Tufekci and Timmons Roberts}
}
@conference {704236,
	title = {Splice: Efficiently Removing a User{\textquoteright}s Data from In-memory Application State},
	booktitle = {CCS 2023},
	year = {2023},
	address = {Copenhagen, Denmark},
	abstract = {Splice is a new programming framework that allows security-conscious applications to efficiently locate and delete a user{\textquoteright}s in-memory state. The core technical challenge is determining how to delete a user{\textquoteright}s memory values without breaking application-specific semantic invariants involving the memory state of remaining users. Splice solves this problem using three techniques: taint tracking (which traces how a user{\textquoteright}s data flows through memory), deletion by synthesis (which overwrites each user-owned memory value in place, replacing it with a value that preserves the symbolic constraints of enclosing data structures), and a novel type system (which forces applications to employ defensive programming to avoid computing over synthesize-deleted values in unsafe ways). Using four realistic applications that we ported to Splice, we show that Splice{\textquoteright}s type system and defensive programming requirements are not onerous for developers. We also demonstrate that Splice{\textquoteright}s runtime overheads are similar to those of prior taint tracking systems, while enabling strong deletion semantics.},
	url = {https://mickens.seas.harvard.edu/sites/scholar.harvard.edu/files/mickens/files/splice.pdf},
	author = {Xueyuan Han and James Mickens and Siddhartha Sen}
}
@conference {688083,
	title = {Carbink: Fault-Tolerant Far Memory},
	booktitle = {OSDI},
	year = {2022},
	month = {July 2022},
	address = {Carlsbad, CA},
	abstract = {Far memory systems allow an application to transparently access local memory as well as memory belonging to remote machines. Fault tolerance is a critical property of any practical approach for far memory, since machine failures (both planned and unplanned) are endemic in datacenters. However, designing a fault tolerance scheme that is efficient with respect to both computation and storage is difficult. In this paper, we introduce Carbink, a far memory system that uses erasure-coding, remote memory compaction, one-sided RMAs, and offloadable parity calculations to achieve fast, storage-efficient fault tolerance. Compared to Hydra, a state-of-the-art fault-tolerant system for far memory, Carbink has 29\% lower tail latency and 48\% higher application performance, with at most 35\% higher memory usage.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/carbink.pdf},
	author = {Yang Zhou and Hassan Wassel and Sihang Liu and Jiaqi Gao and James Mickens and Minlan Yu and Chris Kennelly and Paul Turner and David Culler and Hank Levy and Amin Vahdat}
}
@conference {671736,
	title = {Identifying Valuable Pointers in Heap Data},
	booktitle = {WOOT},
	year = {2021},
	abstract = {
	Historically, attackers have sought to manipulate programs through the corruption of return addresses, function pointers, and other control flow data. However, as protections like ASLR, stack canaries, and no-execute bits have made such attacks more difficult, data-oriented exploits have received increasing attention. Such exploits try to subvert a program by reading or writing non-control data, without introducing any foreign code or violating the program{\textquoteright}s legitimate control flow graph. Recently, a data-oriented exploitation technique called memory cartography was introduced, in which an attacker navigates between allocated memory regions using a precompiled map to disclose sensitive program data. The efficacy of memory cartography is dependent on inter-region pointers being located at constant offsets within memory regions; thus, cartographic attacks are difficult to launch against memory regions like heaps and stacks that have nondeterministic layouts.



	In this paper, we lower the barrier to successful attacks against nondeterministic memory, demonstrating that pointers between regions of memory often possess unique {\textquotedblleft}signatures{\textquotedblright} that allow attackers to identify them with high accuracy. These signatures are accurate even when the pointers reside in non-deterministic memory areas. In many real-world programs, this allows an attacker that is capable of reading bytes from a single heap to access all of process memory. Our findings underscore the importance of memory isolation via separate address spaces.

},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/memory_cartography.pdf},
	author = {James Roney and Troy Appel and Prateek Pinisetti and James Mickens}
}
@conference {661616,
	title = {SIGL: Securing Software Installations Through Deep Graph Learning},
	booktitle = {USENIX Security},
	year = {2021},
	month = {2021},
	abstract = {Many users implicitly assume that software can only be exploited after it is installed. However, recent supply-chain attacks demonstrate that application integrity must be ensured during installation itself. We introduce SIGL, a new tool for detecting malicious behavior during software installation. SIGL collects traces of system call activity, building a data provenance graph that it analyzes using a novel autoencoder architecture with a graph long short-term memory network (graph LSTM) for the encoder and a standard multilayer perceptron for the decoder. SIGL flags suspicious installations as well as the specific installation-time processes that are likely to be malicious. Using a test corpus of 625 malicious installers containing real-world malware, we demonstrate that SIGL has a detection accuracy of 96\%, outperforming similar systems from industry and academia by up to 87\% in precision and recall and 45\% in accuracy. We also demonstrate that SIGL can pinpoint the processes most likely to have triggered malicious behavior, works on different audit platforms and operating systems, and is robust to training data contamination and adversarial attack. It can be used with application-specific models, even in the presence of new software versions, as well as application-agnostic meta-models that encompass a wide range of applications and installers.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/sigl.pdf},
	author = {Xueyuan Han and Xiao Yu and Pasquier, Thomas and Ding Li and Junghwan Rhee and James Mickens and Margo Seltzer and Haifeng Chen}
}
@conference {655234,
	title = {Oblique: Accelerating Page Loads Using Symbolic Execution},
	booktitle = {NSDI},
	year = {2021},
	abstract = {
	\&nbsp;



	\&nbsp;



	Mobile devices are often stuck behind high-latency links. Unfortunately for mobile browsers, latency (not bandwidth) is often the key influence on page load time. Proxy-based web accelerators hide last-mile latency by analyzing a page{\textquoteright}s content, and informing clients about useful objects to prefetch. However, most accelerators require content providers to divulge cleartext HTTPS data to third-party analysis servers. Acceleration systems can be installed on first-party web servers, avoiding the violation of end-to-end TLS security; however, due to the administrative overhead (and additional VM costs) associated with running an accelerator, many first-party content providers would prefer to outsource the acceleration work{\textemdash}if outsourcing could be secure.



	In this paper, we introduce Oblique, a third-party web accelerator which enables secure outsourcing of page analysis. Oblique symbolically executes the client-side of a page load, generating a prefetch list of symbolic URLs. Each symbolic URL describes a URL that a client browser should fetch, given user-specific values for cookies, the User-Agent string, and other sensitive variables. Those sensitive values are never revealed to Oblique{\textquoteright}s analysis server. Instead, during a real page load, the user{\textquoteright}s browser concretizes URLs by reading sensitive local state; the browser can then prefetch the associated objects. Experiments involving real sites demonstrate that Oblique preserves TLS integrity while providing faster page loads than state-of-the-art accelerators. For popular sites, Oblique is also financially cheaper in terms of VM costs.



	\&nbsp;



	\&nbsp;

},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/oblique.pdf},
	author = {Ronny Ko and Blake Loring and Ravi Netravali and James Mickens}
}
@conference {652733,
	title = {Xanthus: Push-button Orchestration of Host Provenance Data Collection},
	booktitle = {Workshop on Practical Reproducible Evaluation of Systems (P-RECS)},
	year = {2020},
	address = {Stockholm, Sweden},
	abstract = {Host-based anomaly detectors generate alarms by inspecting audit logs for suspicious behavior. Unfortunately, evaluating these anomaly detectors is hard. There are few high quality, publicly-available audit logs, and there are no pre-existing frameworks that enable push-button creation of realistic system traces. To make trace generation easier, we created Xanthus, an automated tool that orchestrates virtual machines to generate realistic audit logs. Using Xanthus{\textquoteright} simple management interface, administrators select a base VM image, configure a particular tracing framework to use within that VM, and define post-launch scripts that collect and save trace data. Once data collection is finished, Xanthus creates a self-describing archive which contains the VM, its configuration parameters, and the collected trace data. We demonstrate that Xanthus hides many of the tedious (yet subtle) orchestration tasks that humans often get wrong; Xanthus avoids mistakes that lead to non-replicable experiments.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/xanthus.pdf},
	author = {Xueyuan Han and James Mickens and Ashish Gehani and Margo Seltzer and Pasquier, Thomas}
}
@conference {652129,
	title = {Rethinking Isolation Mechanisms for Datacenter Multitenancy},
	booktitle = {HotCloud},
	year = {2020},
	month = {2020},
	address = {Boston, MA},
	abstract = {In theory, trusted execution environments like SGX are promising approaches for isolating datacenter tenants. In practice, the associated hardware primitives suffer from three major problems: side channels induced by microarchitectural co-tenancy; weak guarantees for post-load software integrity; and opaque hardware implementations which prevent third-party security auditing. We explain why these limitations are so problematic for datacenters, and then propose a new approach for trusted execution. This approach, called IME (Isolated Monitor Execution) provides SGX-style memory encryption, but strictly prevents microarchitectural co-tenancy of secure and insecure code. IME also uses a separate, microarchitecturally-isolated pipeline to run dynamic security checks on monitored code, enabling post-load monitoring for security invariants like CFI or type safety. Finally, an IME processor exports a machine-readable description of its microarchitectural implementation, allowing tenants to reason about the security properties of a particular IME instance.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/ime-hotcloud2020.pdf},
	author = {Varun Gandhi and James Mickens}
}
@conference {650806,
	title = {Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats},
	booktitle = {NDSS},
	year = {2020},
	address = {San Diego, CA},
	abstract = {Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without predefined attack signatures. Using a graph-sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects real-life APT scenarios with high accuracy.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/unicorn.pdf},
	author = {Xueyuan Han and Pasquier, Thomas and Adam Bates and James Mickens and Margo Seltzer}
}
@conference {640860,
	title = {Reverb: Speculative Debugging for Web Applications},
	booktitle = {SOCC 2019},
	year = {2019},
	address = {Santa Cruz, CA},
	abstract = {Bugs are common in web pages. Unfortunately, traditional debugging primitives like breakpoints are crude tools for understanding the asynchronous, wide-area data flows that bind client-side JavaScript code and server-side application logic. In this paper, we describe Reverb, a powerful new debugger that makes data flows explicit and queryable. Reverb provides three novel features. First, Reverb tracks precise value provenance, allowing a developer to quickly identify the reads and writes to JavaScript state that affected a particular variable{\textquoteright}s value. Second, Reverb enables speculative bug fix analysis. A developer can replay a program to a certain point, change code or data in the program, and then resume the replay; Reverb uses the remaining log of nondeterministic events to influence the post-edit replay, allowing the developer to investigate whether the hypothesized bug fix would have helped the original execution run. Third, Reverb supports wide-area debugging for applications whose server-side components use event-driven architectures. By tracking the data flows between clients and servers, Reverb enables speculative replaying of the distributed application.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/reverb.pdf},
	author = {Ravi Netravali and James Mickens}
}
@conference {632891,
	title = {WatchTower: Fast, Secure Mobile Page Loads Using Remote Dependency Resolution},
	booktitle = {MobiSys},
	year = {2019},
	address = {Seoul, South Korea},
	abstract = {Remote dependency resolution (RDR) is a proxy-driven scheme for reducing mobile page load times; a proxy loads a requested page using a local browser, fetching the page{\textquoteright}s resources over fast proxy-origin links instead of a client{\textquoteright}s slow last-mile links. In this paper, we describe two fundamental challenges to efficient RDR proxying: the increasing popularity of encrypted HTTPS content, and the fact that, due to time-dependent network conditions and page properties, RDR proxying can actually increase load times. We solve these problems by introducing a new, secure proxying scheme for HTTPS traffic, and by implementing WatchTower, a selective proxying system that uses dynamic models of network conditions and page structures to only enable RDR when it is predicted to help. WatchTower loads pages 21.2\%{\textendash}41.3\% faster than state-of-the-art proxies and server push systems, while preserving end-to-end HTTPS security.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/watchtower.pdf},
	author = {Ravi Netravali and Anirudh Sivaraman and James Mickens and Hari Balakrishnan}
}
@conference {614185,
	title = {Riverbed: Enforcing User-defined Privacy Constraints in Distributed Web Services},
	booktitle = {NSDI},
	year = {2019},
	address = {Boston, MA},
	abstract = {Riverbed is a new framework for building privacy-respecting web services. Using a simple policy language, users define restrictions on how a remote service can process and store sensitive data. A transparent \&nbsp;Riverbed proxy sits between a user{\textquoteright}s front-end client (e.g., a web browser) and the back-end server code. The back-end code remotely attests to the proxy, demonstrating that the code respects user policies; in particular, the server code attests that it executes within a \&nbsp;Riverbed-compatible managed runtime that uses IFC to enforce user policies. If attestation succeeds, the proxy releases the user{\textquoteright}s data, tagging it with the user-defined policies. On the server-side, the \&nbsp;Riverbed runtime places all data with compatible policies into the same universe (i.e., the same isolated instance of the full web service). The universe mechanism allows \&nbsp;Riverbed to work with unmodified, legacy software; unlike prior IFC systems, \&nbsp;Riverbed does not require developers to reason about security lattices, or manually annotate code with labels. \&nbsp;Riverbed imposes only modest performance overheads, with worst-case slowdowns of 10\% for several real applications.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/riverbed.pdf},
	author = {Frank Wang and Ronny Ko and James Mickens}
}
@conference {613217,
	title = {Alto: Lightweight VMs using Virtualization-aware Managed Runtimes},
	booktitle = {International Conference on Managed Languages \& Runtimes (ManLang)},
	year = {2018},
	address = {Linz, Austria},
	abstract = {Virtualization enables datacenter operators to safely run computations that belong to untrusted tenants. An ideal virtual machine has three properties: a small memory footprint; strong isolation from other VMs and the host OS; and the ability to maintain in-memory state across client requests. Unfortunately, modern virtualization technologies cannot provide all three properties at once. In this paper, we explain why, and propose a new virtualization approach, called Alto, that virtualizes at the layer of a managed runtime interface. Through careful design of (1) the application-facing managed interface and (2) the internal runtime architecture, Alto provides VMs that are small, secure, and stateful. Conveniently, Alto also simplifies VM operations like suspension, migration, and resumption. We provide several details about the proposed design, and discuss the remaining challenges that must be solved to fully realize the Alto vision.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/alto.pdf},
	author = {James Larisch and James Mickens and Eddie Kohler}
}
@conference {610033,
	title = {DeadBolt: Securing IoT Deployments},
	booktitle = {Applied Networking Research Workshop},
	year = {2018},
	address = {Montreal, Quebec, Canada},
	abstract = {In an IoT deployment, network access policies are a critical determinant of security. Devices that run unpatched or insecure code should not be allowed to communicate with the outside world; furthermore, unknown external hosts should not be able to contact sensitive devices that reside within an IoT deployment.In this paper, we introduce DeadBolt, a new security framework for managing IoT network access. DeadBolt hides all of the devices in an IoT deployment behind an access point that implements deny-by-default policies for both incoming and outgoing traffic. The DeadBolt AP also forces high-end IoT devices to use remote attestation to gain network access; attestation allows the devices to prove that they run up-to-date, trusted software. For lightweight IoT devices which lack the ability to attest, the DeadBolt AP uses virtual drivers (essentially, security-focused virtual network functions) to protect lightweight device traffic. For example, a virtual driver might provide network intrusion detection, or encrypt device traffic that is natively cleartext. Using these techniques, and several others, DeadBolt can prevent realistic attacks while imposing only modest performance costs.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/deadbolt.pdf},
	author = {Ronny Ko and James Mickens}
}
@conference {589531,
	title = {Remote-Control Caching: Proxy-based URL Rewriting to Decrease Mobile Browsing Bandwidth},
	booktitle = {HotMobile},
	year = {2018},
	address = {Tempe, Arizona},
	abstract = {Mobile browsers suffer from unnecessary cache misses. The same binary object is often named by multiple URLs which correspond to different cache keys. Furthermore, servers frequently mark objects as uncacheable, even though the objects{\textquoteright} content is stable over time.In this paper, we quantify the excess network traffic that mobile devices generate due to inefficient caching logic. We demonstrate that mobile page loads suffer from more redundant transfers than reported by prior studies which focused on desktop page loads. We then propose a new scheme, called Remote-Control Caching (RC2), in which web proxies (owned by mobile carriers or device manufacturers) track the aliasing relationships between the objects that a client has fetched, and the URLs that were used to fetch those objects. Leveraging knowledge of those aliases, a proxy dynamically rewrites the URLs inside of pages, allowing the client{\textquoteright}s local browser cache to satisfy a larger fraction of requests. Using a concrete implementation of RC2, we show that, for two loads of a page separated by 8 hours, RC2 reduces bandwidth consumption by a median of 52\%. As a result, mobile browsers can save a median of 469 KB per warm-cache page load.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/rc2.pdf},
	author = {Ravi Netravali and James Mickens}
}
@conference {588641,
	title = {Vesper: Measuring Time-to-Interactivity for Web Pages},
	booktitle = {NSDI},
	year = {2018},
	address = {Renton, WA},
	abstract = {Everyone agrees that web pages should load more quickly. However, a good definition for {\textquoteleft}{\textquoteleft}page load time{\textquoteright}{\textquoteright} is elusive. We argue that, in a modern web page, load times should be defined with respect to interactivity: a page is {\textquoteleft}{\textquoteleft}loaded{\textquoteright}{\textquoteright} when above-the-fold content is visible and the associated JavaScript event handling state is functional. We define a new load time metric, called Ready Index, which explicitly captures our proposed notion of load time. Defining the metric is straightforward, but actually measuring it is not, since web developers do not explicitly annotate the JavaScript state and the DOM elements which support interactivity. To solve this problem, we introduce Vesper, a tool which rewrites a page{\textquoteright}s JavaScript and HTML to automatically discover the page{\textquoteright}s interactive state. Armed with Vesper, we compare Ready Index to prior load time metrics like Speed Index; we find that, across a variety of network conditions, prior metrics underestimate or overestimate the true load time for a page by 24\%--64\%. We also introduce a tool that optimizes a page for Ready Index, decreasing the median time to page interactivity by 29\%--32\%.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/vesper-nsdi.pdf},
	author = {Ravi Netravali and Vikram Nathan and James Mickens and Hari Balakrishnan}
}
@conference {588636,
	title = {Prophecy: Accelerating Mobile Page Loads Using Final-state Write Logs},
	booktitle = {NSDI},
	year = {2018},
	address = {Renton, WA},
	abstract = {Web browsing on mobile devices is expensive in terms of battery drainage and bandwidth consumption. Mobile pages also frequently suffer from long load times due to high-latency cellular connections. In this paper, we introduce Prophecy, a new acceleration technology for mobile pages. Prophecy simultaneously reduces energy costs, bandwidth consumption, and page load times. In Prophecy, web servers precompute the JavaScript heap and the DOM tree for a page; when a mobile browser requests the page, the server returns a write log that contains a single write per JavaScript variable or DOM node. The mobile browser replays the writes to quickly reconstruct the final page state, eliding unnecessary intermediate computations. Prophecy{\textquoteright}s server-side component generates write logs by tracking low-level data flows between the JavaScript heap and the DOM. Using knowledge of these flows, Prophecy enables optimizations that are impossible for prior web accelerators; for example, Prophecy can generate write logs that interleave DOM construction and JavaScript heap construction, allowing interactive page elements to become functional immediately after they become visible to the mobile user. Experiments with real pages and real phones show that Prophecy reduces median page load time by 53\%, energy expenditure by 36\%, and bandwidth costs by 21\%.},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/prophecy-nsdi.pdf},
	author = {Ravi Netravali and James Mickens}
}
@conference {579466,
	title = {Veil: Private Browsing Semantics Without Browser-side Assistance},
	booktitle = {NDSS},
	year = {2018},
	address = {San Diego, CA},
	abstract = {
	All popular web browsers offer a "private browsing mode."\&nbsp;After a private session terminates, the browser is supposed to remove client-side evidence that the session occurred. Unfortunately, browsers still leak information through the file system, the browser cache, the DNS cache, and on-disk reflections of RAM such as the swap file.



	Veil is a new deployment framework that allows web developers to prevent these information leaks, or at least reduce their likelihood. Veil leverages the fact that, even though developers do not control the client-side browser implementation, developers do control 1) the content that is sent to those browsers, and 2) the servers which deliver that content. Veil web sites collectively store their content on Veil{\textquoteright}s blinding servers\&nbsp;instead of on individual, site-specific servers. To publish a new page, developers pass their HTML, CSS, and JavaScript files to Veil{\textquoteright}s compiler; the compiler transforms the URLs in the content so that, when the page loads on a user{\textquoteright}s browser, URLs are derived from a secret user key. The blinding service and the Veil page exchange encrypted data that is also protected by the user{\textquoteright}s key. The result is that Veil pages can safely store encrypted content in the browser cache; furthermore, the URLs exposed to system interfaces like the DNS cache are unintelligible to attackers who do not possess the user{\textquoteright}s key. To protect against post-session inspection of swap file artifacts, Veil uses heap walking (which minimizes the likelihood that secret data is paged out), content mutation (which garbles in-memory artifacts if they do get swapped out), and DOM hiding (which prevents the browser from learning site-specific HTML, CSS, and JavaScript content in the first place). Veil pages load on unmodified commodity browsers, allowing developers to provide stronger semantics for private browsing without forcing users to install or reconfigure their machines. Veil provides these guarantees even if the user does not visit a page using a browser{\textquoteright}s native privacy mode; indeed, Veil{\textquoteright}s protections are stronger\&nbsp;than what the browser alone can provide.

},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/veil.pdf},
	author = {Frank Wang and James Mickens}
}
@conference {564676,
	title = {Cobweb: Practical Remote Attestation Using Contextual Graphs},
	booktitle = {SysTEX},
	year = {2017},
	address = {Shanghai, China},
	abstract = {
	In theory, remote attestation is a powerful primitive for building distributed systems atop untrusting peers. Unfortunately, the canonical attestation framework defined by the Trusted Computing Group is insufficient to express rich contextual relationships between client-side software components. Thus, attestors and verifiers must rely on ad-hoc mechanisms to handle real-world attestation challenges like attestors that load executables in nondeterministic orders, or verifiers that require attestors to track dynamic information flows between attestor-side components.



	In this paper, we survey these practical attestation challenges. We then describe a newattestation framework, named Cobweb, which handles these challenges. The key insight is that real-world attestation is a graph problem. An attestation message is a graph in which each vertex is a software component, and has one or more labels, e.g., the hash value of the component, or the raw file data, or a signature over that data. Each edge in an attestation graph is a contextual relationship, like the passage of time, or a parent/child fork() relationship, or a sender/receiver IPC relationship. Cobweb{\textquoteright}s verifier-side policies are graph predicates which analyze contextual relationships. Experiments with real, complex software stacks demonstrate that Cobweb{\textquoteright}s abstractions are generic and can support a variety of real-world policies.

},
	url = {https://mickens.seas.harvard.edu/files/mickens/files/cobweb.pdf},
	author = {Frank Wang and Yuna Joung and James Mickens}
}
@conference {373616,
	title = {Polaris: Faster Page Loads Using Fine-grained Dependency Tracking},
	booktitle = {NSDI},
	year = {2016},
	address = {Santa Clara, CA},
	abstract = {To load a web page, a browser must fetch and evaluate\&nbsp;objects like HTML files and JavaScript source\&nbsp;code. Evaluating an object can result in additional objects\&nbsp;being fetched and evaluated. Thus, loading a web\&nbsp;page requires a browser to resolve a dependency graph;\&nbsp;this partial ordering constrains the sequence in which a\&nbsp;browser can process individual objects. Unfortunately,\&nbsp;many edges in a page{\textquoteright}s dependency graph are unobservable\&nbsp;by today{\textquoteright}s browsers. To avoid violating these hidden\&nbsp;dependencies, browsers make conservative assumptions\&nbsp;about which objects to process next, leaving the network\&nbsp;and CPU underutilized.
We provide two contributions. First, using a new measurement\&nbsp;platform called Scout that tracks fine-grained\&nbsp;data flows across the JavaScript heap and the DOM,\&nbsp;we show that prior, coarse-grained dependency analyzers\&nbsp;miss crucial edges: across a test corpus of 200\&nbsp;pages, prior approaches miss 30\% of edges at the median,\&nbsp;and 118\% at the 95th percentile. Second, we quantify\&nbsp;the benefits of exposing these new edges to web\&nbsp;browsers. We introduce Polaris, a dynamic client-side\&nbsp;scheduler that is written in JavaScript and runs on unmodified\&nbsp;browsers; using a fully automatic compiler,\&nbsp;servers can translate normal pages into ones that load\&nbsp;themselves with Polaris. Polaris uses fine-grained dependency\&nbsp;graphs to dynamically determine which objects to\&nbsp;load, and when. Since Polaris{\textquoteright} graphs have no missing\&nbsp;edges, Polaris can aggressively fetch objects in a way that\&nbsp;minimizes network round trips. Experiments in a variety\&nbsp;of network conditions show that Polaris decreases page\&nbsp;load times by 34\% at the median, and 59\% at the 95th\&nbsp;percentile.},
	url = {http://mickens.seas.harvard.edu/files/mickens/files/polaris.pdf},
	author = {R. Netravali and A. Goyal and J. Mickens and H. Balakrishnan}
}
@conference {373611,
	title = {Sieve: Cryptographically Enforced Access Control for User Data in Untrusted Clouds},
	booktitle = {NSDI},
	year = {2016},
	address = {Santa Clara, CA},
	abstract = {
	Modern web services rob users of low-level control over\&nbsp;cloud storage{\textemdash}a user{\textquoteright}s single logical data set is scattered\&nbsp;across multiple storage silos whose access controls are\&nbsp;set by web services, not users. The consequence is that\&nbsp;users lack the ultimate authority to determine how their\&nbsp;data is shared with other web services.



	In this paper, we introduce Sieve, a new platform which\&nbsp;selectively (and securely) exposes user data to web services.\&nbsp;Sieve has a user-centric storage model: each user\&nbsp;uploads encrypted data to a single cloud store, and by\&nbsp;default, only the user knows the decryption keys. Given\&nbsp;this storage model, Sieve defines an infrastructure to support\&nbsp;rich, legacy web applications. Using attribute-based\&nbsp;encryption, Sieve allows users to define intuitively understandable\&nbsp;access policies that are cryptographically\&nbsp;enforceable. Using key homomorphism, Sieve can reencrypt\&nbsp;user data on storage providers in situ, revoking\&nbsp;decryption keys from web services without revealing new\&nbsp;keys to the storage provider. Using secret sharing and\&nbsp;two factor authentication, Sieve protects cryptographic\&nbsp;secrets against the loss of user devices like smartphones\&nbsp;and laptops. The result is that users can enjoy rich, legacy\&nbsp;web applications, while benefiting from cryptographically\&nbsp;strong controls over which data a web service can access.

},
	url = {http://mickens.seas.harvard.edu/files/mickens/files/sieve.pdf},
	author = {Wang, F. and J. Mickens and N. Zeldovich and V. Vaikuntanathan}
}
@conference {300586,
	title = {Domino: Understanding Wide-Area, Asynchronous Event Causality in Web Applications},
	booktitle = {SOCC (short paper)},
	year = {2015},
	address = {Kohala Coast, Hawai{\textquoteright}i},
	abstract = {In a modern web application, a single high-level action like\&nbsp;a mouse click triggers a flurry of asynchronous events on\&nbsp;the client browser and remote web servers. We introduce\&nbsp;Domino, a new tool which automatically captures and analyzes end-to-end, asynchronous causal relationship of events\&nbsp;that span clients and servers. Using Domino, we found uncharacteristically long event chains in Bing Maps, discovered data races in the WinJS implementation of promises,\&nbsp;and developed a new server-side scheduling algorithm for\&nbsp;reducing the tail latency of server responses.},
	url = {http://scholar.harvard.edu/files/mickens/files/domino.pdf},
	author = {Ding Li and James Mickens and Suman Nath and Lenin Ravindranath}
}
@conference {300486,
	title = {Amber: Decoupling User Data from Web Applications},
	booktitle = {HotOS},
	year = {2015},
	address = {Kartause Ittingen, Switzerland},
	abstract = {User-generated content is becoming increasingly common\&nbsp;on the Web, but current web applications isolate\&nbsp;their users{\textquoteright} data, enabling only restricted sharing and\&nbsp;cross-service integration. We believe users should be able\&nbsp;to share their data seamlessly between their applications\&nbsp;and with other users. To that end, we propose Amber, an\&nbsp;architecture that decouples users{\textquoteright} data from applications,\&nbsp;while providing applications with powerful global queries\&nbsp;to find user data. We demonstrate how multi-user applications,\&nbsp;such as e-mail, can use these global queries to\&nbsp;efficiently collect and monitor relevant data created by\&nbsp;other users. Amber puts users in control of which applications\&nbsp;they use with their data and with whom it is shared,\&nbsp;and enables a new class of applications by removing the\&nbsp;artificial partitioning of users{\textquoteright} data by application.},
	url = {http://scholar.harvard.edu/files/mickens/files/amber.pdf},
	author = {Tej Chajed and Jon Gjengset and Jelle van den Hooff and M. Frans Kaashoek and James Mickens and Robert Morris and Nickolai Zeldovich}
}
@conference {300481,
	title = {Mahimahi: Accurate Record-and-Replay for HTTP},
	booktitle = {USENIX ATC},
	year = {2015},
	address = {Santa Clara, CA},
	abstract = {This paper presents Mahimahi, a framework to record\&nbsp;traffic from HTTP-based applications, and later replay it\&nbsp;under emulated network conditions. Mahimahi improves\&nbsp;upon prior record-and-replay frameworks in three ways.\&nbsp;First, it is more accurate because it carefully emulates the\&nbsp;multi-server nature of Web applications, present in 98\%\&nbsp;of the Alexa US Top 500 Web pages. Second, it isolates\&nbsp;its own network traffic, allowing multiple Mahimahi instances\&nbsp;emulating different networks to run concurrently\&nbsp;without mutual interference. And third, it is designed as\&nbsp;a set of composable shells, providing ease-of-use and extensibility.

We evaluate Mahimahi by: (1) analyzing the performance\&nbsp;of HTTP/1.1, SPDY, and QUIC on a corpus of 500\&nbsp;sites, (2) using Mahimahi to understand the reasons why\&nbsp;these protocols are suboptimal, (3) developing Cumulus,\&nbsp;a cloud-based browser designed to overcome these\&nbsp;problems, using Mahimahi both to implement Cumulus\&nbsp;by extending one of its shells, and to evaluate it, (4) using\&nbsp;Mahimahi to evaluate HTTP multiplexing protocols\&nbsp;on multiple performance metrics (page load time and\&nbsp;speed index), and (5) describing how others have used\&nbsp;Mahimahi.},
	url = {http://scholar.harvard.edu/files/mickens/files/mahimahi.pdf},
	author = {Ravi Netravali and Anirudh Sivaraman and Somak Das and Ameesh Goyal and Keith Winstein and James Mickens and Hari Balakrishnan}
}
@conference {300476,
	title = {Mj{\"o}lnir: The Magical Web Application Hammer},
	booktitle = {APSys},
	year = {2015},
	address = {Tokyo, Japan},
	abstract = {Conventional wisdom suggests that rich, large-scale web\&nbsp;applications are difficult to build and maintain. An implicit\&nbsp;assumption behind this intuition is that a large web\&nbsp;application requires massive numbers of servers, and complicated,\&nbsp;one-off back-end architectures. We provide\&nbsp;empirical evidence to disprove this intuition. We then\&nbsp;propose new programming abstractions and a new deployment\&nbsp;model that reduce the overhead of building and\&nbsp;running web services.},
	url = {http://scholar.harvard.edu/files/mickens/files/mjolnir.pdf},
	author = {Jelle van den Hooff and David Lazar and James Mickens}
}
@conference {300501,
	title = {Blizzard: Fast, Cloud-scale Block Storage for Cloud-oblivious Applications},
	booktitle = {NSDI},
	year = {2014},
	address = {Seattle, WA},
	abstract = {Blizzard is a high-performance block store that exposes\&nbsp;cloud storage to cloud-oblivious POSIX and\&nbsp;Win32 applications. Blizzard connects clients and\&nbsp;servers using a network with full-bisection bandwidth,\&nbsp;allowing clients to access any remote disk as fast as if\&nbsp;it were local. Using a novel striping scheme, Blizzard\&nbsp;exposes high disk parallelism to both sequential and random\&nbsp;workloads; also, by decoupling the durability and\&nbsp;ordering requirements expressed by flush requests, Blizzard\&nbsp;can commit writes out-of-order, providing high performance\&nbsp;and crash consistency to applications that issue\&nbsp;many small, random IOs. Blizzard{\textquoteright}s virtual disk drive,\&nbsp;which clients mount like a normal physical one, provides\&nbsp;maximum throughputs of 1200 MB/s, and can improve\&nbsp;the performance of unmodified, cloud-oblivious applications\&nbsp;by 2x{\textendash}10x. Compared to EBS, a commercially\&nbsp;available, state-of-the-art virtual drive for cloud applications,\&nbsp;Blizzard can improve SQL server IOp rates by\&nbsp;seven-fold while still providing crash consistency.},
	url = {http://scholar.harvard.edu/files/mickens/files/blizzard.pdf},
	author = {James Mickens and Edmund B. Nightingale and Jeremy Elson and Krishna Nareddy and Darren Gehring and Bin Fan and Asim Kadav and Vijay Chidambaram and Osama Khan}
}
@conference {300496,
	title = {Pivot: Fast, Synchronous Mashup Isolation Using Generator Chains},
	booktitle = {IEEE Symposium on Security and Privacy},
	year = {2014},
	address = {San Jose, CA},
	abstract = {
	Pivot is a new JavaScript isolation framework for\&nbsp;web applications. Pivot uses iframes as its low-level isolation\&nbsp;containers, but it uses code rewriting to implement synchronous\&nbsp;cross-domain interfaces atop the asynchronous cross-frame\&nbsp;postMessage() primitive. Pivot layers a distributed\&nbsp;scheduling abstraction across the frames, essentially treating\&nbsp;each frame as a thread which can invoke RPCs that are\&nbsp;serviced by external threads. By rewriting JavaScript call\&nbsp;sites, Pivot can detect RPC invocations; Pivot exchanges RPC\&nbsp;requests and responses via postMessage(), and it pauses\&nbsp;and restarts frames using a novel rewriting technique that\&nbsp;translates each frame{\textquoteright}s JavaScript code into a restartable\&nbsp;generator function. By leveraging both iframes and rewriting,\&nbsp;Pivot does not need to rewrite all code, providing an order-of-magnitude performance improvement over rewriting-only\&nbsp;solutions. Compared to iframe-only approaches, Pivot provides\&nbsp;synchronous RPC semantics, which developers typically prefer\&nbsp;over asynchronous RPCs. Pivot also allows developers to use\&nbsp;the full, unrestricted JavaScript language, including powerful\&nbsp;statements like eval().

},
	url = {http://scholar.harvard.edu/files/mickens/files/pivot.pdf},
	author = {James Mickens}
}
@conference {300591,
	title = {Shroud: Ensuring Private Access to Large-Scale Data in the Data Center},
	booktitle = {FAST},
	year = {2013},
	address = {San Jose, CA},
	abstract = {Recent events have shown online service providers\&nbsp;the perils of possessing private information about users.\&nbsp;Encrypting data mitigates but does not eliminate this\&nbsp;threat: the pattern of data accesses still reveals information.\&nbsp;Thus, we present Shroud, a general storage system\&nbsp;that hides data access patterns from the servers running\&nbsp;it, protecting user privacy. Shroud functions as a virtual\&nbsp;disk with a new privacy guarantee: the user can look up a\&nbsp;block without revealing the block{\textquoteright}s address. Such a virtual\&nbsp;disk can be used for many purposes, including map\&nbsp;lookup, microblog search, and social networking.

Shroud aggressively targets hiding accesses among\&nbsp;hundreds of terabytes of data. We achieve our goals by\&nbsp;adapting oblivious RAM algorithms to enable large-scale\&nbsp;parallelization. Specifically, we show, via new techniques\&nbsp;such as oblivious aggregation, how to securely\&nbsp;use many inexpensive secure coprocessors acting in parallel\&nbsp;to improve request latency. Our evaluation combines\&nbsp;large-scale emulation with an implementation on\&nbsp;secure coprocessors and suggests that these adaptations\&nbsp;bring private data access closer to practicality.},
	url = {http://scholar.harvard.edu/files/mickens/files/shroud.pdf},
	author = {Jacob R. Lorch and Bryan Parno and James Mickens and Mariana Raykova and Joshua Schiffman}
}
@conference {300596,
	title = {Gibraltar: Exposing Hardware Devices to Web Pages Using AJAX},
	booktitle = {USENIX WebApps},
	year = {2012},
	address = {Boston, MA},
	abstract = {Gibraltar is a new framework for exposing hardware devices\&nbsp;to web pages. Gibraltar{\textquoteright}s fundamental insight is that JavaScript{\textquoteright}s AJAX facility can be used as a hardware access protocol.\&nbsp;Instead of relying on the browser to mediate device interactions,\&nbsp;Gibraltar sandboxes the browser and uses a small\&nbsp;device server to handle hardware requests. The server uses\&nbsp;native code to interact with devices, and it exports a standard\&nbsp;web server interface on the localhost. To access hardware,\&nbsp;web pages send device commands to the server using\&nbsp;HTTP requests; the server returns hardware data via HTTP\&nbsp;responses.
Using a client-side JavaScript library, we build a simple\&nbsp;yet powerful device API atop this HTTP transfer protocol.\&nbsp;The API is particularly useful to developers of mobile web\&nbsp;pages, since mobile platforms like cell phones have an increasingly\&nbsp;wide array of sensors that, prior to Gibraltar, were\&nbsp;only accessible via native code plugins or the limited, inconsistent\&nbsp;APIs provided by HTML5. Our implementation of\&nbsp;Gibraltar on Android shows that Gibraltar provides stronger\&nbsp;security guarantees than HTML5; furthermore, it shows that\&nbsp;HTTP is responsive enough to support interactive web pages\&nbsp;that perform frequent hardware accesses. Gibraltar also supports\&nbsp;an HTML5 compatibility layer that implements the\&nbsp;HTML5 interface but provides Gibraltar{\textquoteright}s stronger security.},
	url = {http://scholar.harvard.edu/files/mickens/files/gibraltar.pdf},
	author = {Kaisen Lin and David Chu and James Mickens and Li Zhuang and Feng Zhao and Jian Qiu}
}
@conference {300601,
	title = {Jigsaw: Efficient, Low-effort Mashup Isolation},
	booktitle = {USENIX WebApps},
	year = {2012},
	address = {Boston, MA},
	abstract = {A web application often includes content from a variety\&nbsp;of origins. Securing such a mashup application\&nbsp;is challenging because origins often distrust each other\&nbsp;and wish to expose narrow interfaces to their private\&nbsp;code and data. Jigsaw is a new framework for isolating\&nbsp;these mashup components. Jigsaw is an extension of\&nbsp;the JavaScript language that can be run inside standard\&nbsp;browsers using a Jigsaw-to-JavaScript compiler. Unlike\&nbsp;prior isolation schemes that require developers to\&nbsp;specify complex, error-prone policies, Jigsaw leverages\&nbsp;the well-understood public/private keywords from traditional\&nbsp;object-oriented languages, making it easy for a domain\&nbsp;to tag internal data as externally visible. Jigsaw\&nbsp;provides strong iframe-like isolation, but unlike previous\&nbsp;approaches that use actual iframes as isolation containers,\&nbsp;Jigsaw allows mutually distrusting code to run\&nbsp;inside the same frame; this allows scripts to share state\&nbsp;using synchronous method calls instead of asynchronous\&nbsp;message passing. Jigsaw also introduces a novel encapsulation\&nbsp;mechanism called surrogates. Surrogates allow\&nbsp;domains to safely exchange objects by reference instead\&nbsp;of by value. This improves sharing efficiency by eliminating\&nbsp;cross-origin marshaling overhead.},
	url = {http://scholar.harvard.edu/files/mickens/files/jigsaw.pdf},
	author = {James Mickens and Matthew Finifter}
}
@conference {300606,
	title = {Rivet: Browser-agnostic Remote Debugging for Web Applications},
	booktitle = {USENIX ATC},
	year = {2012},
	address = {Boston, MA},
	abstract = {Rivet is the first fully-featured, browser-agnostic remote debugger for web applications. Using Rivet, developers can inspect and modify the state of live web\&nbsp;pages that are running inside unmodified end-user web\&nbsp;browsers. This allows developers to explore real application bugs in the context of the actual machines on which\&nbsp;those bugs occur. To make an application Rivet-aware,\&nbsp;developers simply add the Rivet JavaScript library to the\&nbsp;client-side portion of the application. Later, when a user\&nbsp;detects a problem with the application, the user informs\&nbsp;Rivet; in turn, Rivet pauses the application and notifies\&nbsp;a remote debug server that a debuggable session is available. The server can launch an interactive debugger front-end for a human developer, or use Rivet{\textquoteright}s live patching\&nbsp;mechanism to automatically install a fix on the client or\&nbsp;run diagnostics for offline analysis. Experiments show\&nbsp;that Rivet imposes negligible overhead during normal application operation. At debug time, Rivet{\textquoteright}s network footprint is small, and Rivet is computationally fast enough to\&nbsp;support non-trivial diagnostics and live patches.},
	url = {http://scholar.harvard.edu/files/mickens/files/rivet.pdf},
	author = {James Mickens}
}
@conference {300611,
	title = {Atlantis: Robust, Extensible Execution Environments for Web Applications},
	booktitle = {SOSP},
	year = {2011},
	address = {Cascais, Portugal},
	abstract = {Today{\textquoteright}s web applications run inside a complex browser environment\&nbsp;that is buggy, ill-specified, and implemented in\&nbsp;different ways by different browsers. Thus, web applications\&nbsp;that desire robustness must use a variety of conditional code\&nbsp;paths and ugly hacks to deal with the vagaries of their runtime.\&nbsp;Our new exokernel browser, called Atlantis, solves\&nbsp;this problem by providing pages with an extensible execution\&nbsp;environment. Atlantis defines a narrow API for basic\&nbsp;services like collecting user input, exchanging network data,\&nbsp;and rendering images. By composing these primitives, web\&nbsp;pages can define custom, high-level execution environments.\&nbsp;Thus, an application which does not want a dependence on\&nbsp;Atlantis{\textquoteright} predefined web stack can selectively redefine components\&nbsp;of that stack, or define markup formats and scripting\&nbsp;languages that look nothing like the current browser runtime.\&nbsp;Unlike prior microkernel browsers like OP, and unlike\&nbsp;compile-to-JavaScript frameworks like GWT, Atlantis is the\&nbsp;first browsing system to truly minimize a web page{\textquoteright}s dependence\&nbsp;on black box browser code. This makes it much easier\&nbsp;to develop robust, secure web applications.},
	url = {http://scholar.harvard.edu/files/mickens/files/atlantis.pdf},
	author = {James Mickens and Mohan Dhawan}
}
