Flow-sensitive, context-sensitive, and object-sensitive information flow control based on program dependence graphs

Abstract

Information flow control (IFC) checks whether a program can leak secret data to public ports, or whether critical computations can be influenced from outside. But many IFC analyses are imprecise, as they are flow-insensitive, context-insensitive, or object-insensitive; resulting in false alarms. We argue that IFC must better exploit modern program analysis technology, and present an approach based on program dependence graphs (PDG). PDGs have been developed over the last 20 years as a standard device to represent information flow in a program, and today can handle realistic programs. In particular, our dependence graph generator for full Java bytecode is used as the basis for an IFC implementation which is more precise and needs less annotations than traditional approaches. We explain PDGs for sequential and multi-threaded programs, and explain precision gains due to flow-, context-, and object-sensitivity. We then augment PDGs with a lattice of security levels and introduce the flow equations for IFC. We describe algorithms for flow computation in detail and prove their correctness. We then extend flow equations to handle declassification, and prove that our algorithm respects monotonicity of release. Finally, examples demonstrate that our implementation can check realistic sequential programs in full Java bytecode.

From Exponential to Polynomial-Time Security Typing via Principal Types

“…Later work by Horwitz et al [HRB90] casts the slicing problem as a graph traversal problem and extends the basic algorithm to the inter-procedural case, using a powerful grammar-based technique to analyse procedure calls in a context-sensitive manner. Hammer and Snelting [HS09,Ham10] explicitly apply this graph-based approach to the problem of information flow analysis. The algorithm presented by Horwitz et al is polynomial but the accompanying algorithmic analysis is stated for measures which are specific to their grammar constructions, preventing any straightforward comparison with the algorithm sketched for procedures in the current paper.…”

Representation-Independent Data Usage Control

“…In terms of data flow tracking, our approach restricts the standard notion of information flow analysis which also caters to implicit flows and aims at noninterference assessments [37,38,21,22]: our system detects only flows from container to container. This explains why we prefer to speak of data flow rather than information flow.…”

“…opened, (lines 12-15) at most 4 further times and within 30 seconds (1 timestep = 1 second) after the first use (lines [8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27]; further attempts of opening the file will result in opening a predefined error message (lines 28-34).…”

“…We do not discuss performance nor policy management either. Contribution Data flow tracking at specific layers of abstraction has been done in a multitude of ways [3,4,[11][12][13][14][15][16][17][18][19][20], also in the form of information flow analyses where implicit flows are also taken into account [21,22]. As far as we are aware, this work ends where sensitive (or tainted) data is moved to illegal sinks, e.g., when a file is written or an http post request is sent.…”

An Approach to Detecting Inter-Session Data Flow Induced by Object Pooling

“…Hammer and Snelting describe how static analysis can be used to check whether the confidentiality or the integrity of the data processed by a program can be threatened by a user [13]. For their information-flow control, they use a program dependence graph, a representation already known in the area of static program analysis [15,3,11].…”