Certification of programs for secure information flow

Abstract

This paper presents a certification mechanism for verifying the secure flow of information through a program. Because it exploits the properties of a lattice structure among security classes, the procedure is sufficiently simple that it can easily be included in the analysis phase of most existing compilers. Appropriate semantics are presented and proved correct. An important application is the confinement problem: The mechanism can prove that a program cannot cause supposedly nonconfidential results to depend on confidential input data.

Dynamic vs. Static Flow-Sensitive Security Analysis

“…Intuitively, Figure 5. Flow-sensitive type system the judgment expresses that the security levels of variables are determined by Γ before executing command c, and Γ describes the security levels of variables after the execution of c. The security level pc represents a program counter level recording the level of the context in order to avoid illegal implicit flows [18]. The type system uses judgments of the form Γ e : t to determine that the security level of expression e is t. This judgment is simply defined as the join of security levels associated with variables that appear in the expression.…”

“…For example, program public := secret exhibits an explicit flow from secret to public. Information is passed via controlflow structure in an implicit flow [18]. For example, program if secret then public := 1 has an implicit flow.…”

“…One alternative to prevent explicit and implicit flows is purely static Denning-style enforcement [18], [52], [42]. For example, each assignment is checked for the following property: the level of the assigned variable must be high in case there is a high variable on the right-hand side of the assignment (tracking explicit flows) or in case the assignment appears inside of a high conditional or loop (tracking implicit flows).…”

Protecting Cloud Data Using the Decentralized Information Flow Control with Authorization Condition

“…In order to refine data protection and support data flow, IFC [9] was put forward. Subsequently, Myers extended it to distributed computing system and presented DIFC [10].…”

An Efficient Information Flow Analysis of Recursive Programs Based on a Lattice Model of Security Classes

“…Experimental results are briefly presented in section 5. [D76] and [DD77] are the pioneering works which proposed a systematic method of analyzing information flow based on a lattice model of security classes. Subsequently, Denning's analysis method has been formalized and extended in a various way by Hoare-style axiomatization [BBM94], by abstract interpretation [O95], and by type theory [VS97,HR98,LR98].…”