Security
We used model-checking to evaluate the combined security
characteristics of app isolation using both state isolation and
entry-point restriction. Our approach consists of dening the
security goals of app isolation, then modeling our implemen-
tation, its security goals, and attacker behavior in the web
security framework described in [9] using Alloy [30, 31], a
declarative modeling language based on rst-order relational
logic. We then analyze whether the expressed goals were met
with the help of the Alloy analyzer software.