Information flow control for standard OS abstractions

Abstract

Decentralized Information Flow Control (DIFC) [24] is an approach to security that allows application writers to control how data flows between the pieces of an application and the outside world. As applied to privacy, DIFC allows untrusted software to compute with private data while trusted security code controls the release of that data. As applied to integrity, DIFC allows trusted code to protect untrusted software from unexpected malicious inputs. In either case, only bugs in the trusted code, which tends to be small and isolated, can lead to security violations.We present Flume, a new DIFC model and system that applies at the granularity of operating system processes and standard OS abstractions (e.g., pipes and file descriptors). Flume eases DIFC's use in existing applications and allows safe interaction between conventional and DIFC-aware processes. Flume runs as a user-level reference monitor on Linux. A process confined by Flume cannot perform most system calls directly; instead, an interposition layer replaces system calls with IPC to the reference monitor, which enforces data flow policies and performs safe operations on the process's behalf. We ported a complex Web application (MoinMoin wiki) to Flume, changing only 2% of the original code. The Flume version is roughly 30-40% slower due to overheads in our current implementation but supports additional security policies impossible without DIFC.

Managing information for personal goals (vision)

“…A foundation for distinguishing important exposure of information from acceptable use in aggregates is "differential privacy" [48]. c) Particular platforms: Adding tags to data items can track how information flows through a program, a database, a web application or an operating system [49], [50], [51], [52]. Tracking and visualising large volumes of provenance as information flows among cloud-hosted applications has been studied [53], [54], [55].…”

A Decentralized Information Flow Model for SaaS Applications Security

“…DIFC follows traditional IFC and add decentralized privilege. Some [6] are finegrained language-level DIFC systems while the others [7] are OS-level DIFC systems to protect the the system resources. To meet the security requirements of SaaS users, we choose to provide the controlling granularity of process.…”

Information Flow Control for Intrusion Detection Derived from MAC Policy

“…Implementations of MLS models try to precisely observe data manipulations in order to prevent illegal information flows. Flume [8], and Histar [15] are modern implementations of information flow control. Flume is an implementation of distributed information flow control (DIFC) for Linux, acting at the OS level, and using standard OS abstractions (processes, pipes, .…”