News

Researchers Say Gazelle Browser Offers Better Security

A team consisting of Microsoft Research personnel and university staff members has demonstrated a potentially more secure Web browser called Gazelle. A paper (PDF) describing the browser prototype was published at Microsoft Research on Thursday.

However this research team, led by Helen J. Wang and others, appears to be doing work that's separate from Microsoft's Internet Explorer 8 team. IE8 and Google Chrome frequently appear in the paper as examples of browsers that get security wrong.

The team claims that the Gazelle browser, which ran on Windows Vista and uses Internet Explorer's Trident renderer, offers greater security by using a browser-based operating system called a "browser kernel." The browser kernel consists of approximately 5,000 lines of C# code and is "resilient to memory attacks," according to the authors. Not even IE8 offers the same protection, they contend.

"No existing browsers, including new architectures like IE 8, Google Chrome, and OP [another experimental browser], have a multi-principal OS construction that gives a browser-based OS, typically called Browser Kernel, the exclusive control to manage the protection and fair-sharing of all system resources among browser principals," the authors write.

The Gazelle browser enables Web sites (or "principals") to communicate with each other, but they do so by passing messages through the browser kernel, just as would be done via interprocess communications. The browser kernel manages security as well as the sharing of system resources.

In contrast to Google Chrome, Gazelle runs a Web page and its embedded principals in separate processes. The authors also claim that Gazelle handles tabbed browsing in a superior way to IE8.

"IE 8 uses OS processes to isolate tabs from one another. This granularity is insufficient since a user may browse multiple mutually distrusting sites in a single tab and a web page may contain an iframe with content from an untrusted site (e.g., ads)," the authors explain.

Gazelle separates same-origin domains, such as ad.datacenter.com and user.datacenter.com, whereas Google Chrome considers them from the same site. The browser kernel even manages address bars and menus in the browser, plus it controls whether or not browser plug-ins can interoperate with the operating system.

The overlay of transparent content, which can trick users into clicking on content from another origin, is thwarted by a policy that makes dynamic content-containing windows opaque.

Gazelle still has leaps and bounds to travel to get beyond its prototype stage. In many instances, Gazelle is slower than IE7 due to greater overhead, although it does start up faster than IE7.

Gazelle also may choke on the browser plug-in issue. The authors explain that "existing plugin software must be adapted (ported or binary-rewritten) to use Browser Kernel system calls to accomplish its tasks."

The authors did test Gazelle successfully on 19 of 20 Alexa-reported popular Web sites, calling the browser's performance "acceptable." Some of the overhead problems caused by "IE instrumentation" can be eliminated, the authors say.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.

Featured

  • Microsoft Ups Its Carbon Reduction Goals

    Microsoft on Thursday announced a corporatewide carbon reduction effort that aims to make the company "carbon negative" by 2030.

  • How To Dynamically Lock Down an Unattended Windows 10 PC

    One of the biggest security risks in any organization happens when a user walks away from their PC without logging out. Microsoft has the solution (and it's not a password-protected screensaver).

  • First Stable Chromium-Based Microsoft Edge Browser Released

    Microsoft on Wednesday announced the first release of its Chromium-based Microsoft Edge browser at the "stable" commercial-release stage.

  • Microsoft's January Security Updates Come with NSA Help

    Microsoft released its January security updates with a partial assist from the U.S. National Security Agency (NSA).

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.