FlowShield · Securing Web Applications by Information Flow Tracking

In today’s technology-centric world, web applications are a keyenabler for many day-to-day activities ranging from online banking toin-vehicle infotainment. These applications have access to a wealth ofsensitive information. Unauthorized disclosure and corruption of thisinformation may result in financial damage, privacy violations, andloss of human lives.At the heart of modern web applications lies the *JavaScript*language. When a user visits a web page, JavaScript code fromdifferent sources is downloaded into the user’s browser and run *withthe same privileges* as if the code came from the web pageitself. This implies that to attack a web page, it is sufficient tocompromise a third-party code component.Drawing on the technology of *information flow tracking* developed bythe PI’s ERC project, FlowShield will provide *an innovative platformfor security testing and secure integration* of JavaScript code fromdifferent providers. This will enable ICT companies to benefit fromthe tremendous business opportunities created by third-party services,while providing secure products to their customers.With banking and automotive industries as prime targets, FlowShieldwill confirm the potential of our security solution by investigatingmarket trends, competitors, Intellectual Property Rights (IPR) andbusiness models, while seeking strategic alliances with industrial andinnovation actors. The goal is to identify concrete marketapplications and business models for securing web applications byutilizing the information flow tracking technology. FlowShield willallow ICT companies to benefit from the tremendous businessopportunities created by third-party services, while providing secureproducts to their customers.