Towards Multicolored Computing - Compartmented Security to Prevent Phishing Attacks

Identity theft through phishing attacks has fostered to a major concern of Internet users. Classical phishing attacks aim at luring the user to a faked web site to disclose personal information. Various solutions have been proposed against this kind of attack. However, these solutions can hardly counter the new generation of sophisticated malware phishing attacks designed to target certain services. This paper aims at making the first steps towards the design and implementation of an open source and interoperable security architecture that prevents both classical and malware phishing attacks. Our approach is based on the ideas of (i) the multicolored computing (e.g., red for the risky and green for the trusted domain), and (ii) a trusted wallet for storing credentials and authenticating sensitive services. Our solution requires no special care from users for identifying the right web sites while the disclosure of credentials is strictly controlled. We present the main idea of how to integrate countermeasures against Phishing and malware into one sound security architecture. Our approach establishes compartmented security for mounting isolated applications, provides a secure graphical user interface to configure sensitive applications, and performs secure booting to preserve the system integrity. We also give hints on how to implement this architecture efficiently by utilizing trusted computing functionality and virtualization.