Decentralized Delimited Release

Magazinius, Jonas; Askarov, Aslan; Sabelfeld, Andrei

doi:10.1007/978-3-642-25318-8_18

Cited by 6 publications

(5 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There has been other work on abstract interpretation for information flow and even declassification, but using abstractions of single executions [39]. A general framework could facilitate investigation of alternate monitoring techniques such as fully dynamic monitoring [10], [40].…”

Section: Discussionmentioning

confidence: 99%

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Chudnov

Kuan²,

Naumann

2014

2014 IEEE 27th Computer Security Foundations Symposium

View full text Add to dashboard Cite

A number of systems have been developed for dynamic information flow control (IFC). In such systems, the security policy is expressed by labeling input and output channels; it is enforced by tracking and checking labels on data. Systems have been proven to enforce some form of noninterference (NI), formalized as a property of two runs of the program. In practice, NI is too strong and it is desirable to enforce some relaxation of NI that allows downgrading under constraints that have been classified as 'what', 'where', 'who', or 'when' policies. To encompass a broad range of policies, relational logic has been proposed as a means to specify and statically enforce policy. This paper shows how relational logic policies can be dynamically checked. To do so, we provide a new account of monitoring, in which the monitor state is viewed as an abstract interpretation of sets of pairs of program runs.

show abstract

Section: Discussionmentioning

confidence: 99%

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Chudnov

Kuan²,

Naumann

2014

2014 IEEE 27th Computer Security Foundations Symposium

View full text Add to dashboard Cite

show abstract

“…Type systems that are designed to prevent information laundering [44,2,7,33] reject the program above, because of the update to variable h on Line 3, and thus these type systems appear unsuitable for straightforward adaptation to progress sensitivity.…”

Section: Discussion and Related Workmentioning

confidence: 99%

Precise enforcement of progress-sensitive security

Moore

Askarov

Chong

2012

Proceedings of the 2012 ACM Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Program progress (or termination) is a covert channel that may leak sensitive information. To control information leakage on this channel, semantic definitions of security should be progress sensitive and enforcement mechanisms should restrict the channel's capacity. However, most state-of-the-art language-based informationflow mechanisms are progress insensitive-allowing arbitrary information leakage through this channel-and current progress-sensitive enforcement techniques are overly restrictive.We propose a type system and instrumented semantics that together enforce progress-sensitive security more precisely than existing approaches. Our system is permissive in that it is able to accept programs in which the termination behavior depends only on low-security (e.g., public or trusted) information. Our system is parameterized on a termination oracle, and controls the progress channel precisely, modulo the ability of the oracle to determine the termination behavior of a program based on low-security information. We have instantiated the oracle for a simple imperative language with a logical abstract interpretation that uses an SMT solver to synthesize linear rank functions.In addition, we extend the system to permit controlled leakage through the progress channel, with the leakage bound by an explicit budget. We empirically analyze progress channels in existing Jif code. Our evaluation suggests that security-critical programs appear to satisfy progress-sensitive security.

show abstract

“…They use an instrumented semantics with the set of declassified expressions. Magazinius et al [31] proposed decentralized delimited released, combining the what and who dimensions in decentralized settings and consider a web attacker model. In the context of multiple facets [5], Austin and Flanagan show how to perform robust declassification (who dimension) with integrity guarantees against active attackers.…”

Section: Related Work a Information Flow Security And Declassifmentioning

confidence: 99%

“…Secure multi-execution was implemented in the Flowfox browser [3], [18], but could only handle noninterference policies before this work. To the best of our knowledge, decentralized delimited released [31] and multiple facets [5] are the only works that attempt to control declassication in real web scripts. In particular the work targets a subset of the JavaScript language.…”

Section: Related Work a Information Flow Security And Declassifmentioning

confidence: 99%

Stateful Declassification Policies for Event-Driven Programs

Vanhoef

Groef

Devriese

et al. 2014

2014 IEEE 27th Computer Security Foundations Symposium

View full text Add to dashboard Cite

We propose a novel mechanism for enforcing information flow policies with support for declassification on event-driven programs. Declassification policies consist of two functions. First, a projection function specifies for each confidential event what information in the event can be declassified directly. This generalizes the traditional security labelling of inputs. Second, a stateful release function specifies the aggregate information about all confidential events seen so far that can be declassified. We provide evidence that such declassification policies are useful in the context of JavaScript web applications. An enforcement mechanism for our policies is presented and its soundness and precision is proven. Finally, we give evidence of practicality by implementing and evaluating the mechanism in a browser.

show abstract

Decentralized Delimited Release

Cited by 6 publications

References 35 publications

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Precise enforcement of progress-sensitive security

Stateful Declassification Policies for Event-Driven Programs

Contact Info

Product

Resources

About