webinos project deliverable: Phase 2 Security Framework

The webinos project defines and delivers an open source web application runtime compatible with a wide range of smart devices, including smartphones, tablets, PCs, in-car systems and set-top boxes. A key aim of the project is building a platform which is both secure and protects user privacy. This document describes the security and privacy rational, threat model and architectural risk analysis used by the project. It is a companion document to the webinos system and API specifications and explains why certain security and privacy controls exist and what risks remain. It provides a set of recommendations and describes the outstanding weaknesses and issues of which webinos stakeholders may need to be aware.