Information flow control of component‐based distributed systems

Abstract

SUMMARYNoninterference is a strong security policy that enforces confidentiality and integrity. Many solutions are proposed in the state of the art for verifying this policy in programs, but few tools are proposed to implement it. In this paper, we define a high‐level model called Component Information Flow, and we develop the tools that simplify distributed secure system development and deployment.The developer focuses on developing the functional part of his or her system and defines his or her system security properties by using a high‐level configuration. When this configuration is validated, that is, no security leak is detected, the system security code is generated. To validate and demonstrate the effectiveness of our approach, we apply the Component Information Flow tools to a classical Web service use case. Copyright © 2012 John Wiley & Sons, Ltd.

Integrating Messaging Middleware and Information Flow Control

“…Component Information Flow [13] is a design framework for component-based system architectures where security constraints (labels) can be specified on communication interfaces. It provides tools for model validation and code generation.…”

Securing collaborative Web applications

“…In our work, no language shift is required for common Java developers. Furthermore, our work is classified in component-based information flow security [7] [8]. We adopt the composition in IFC verification in our web environment since we split the IFC verification following the MVC layers.…”

Controlling Information Flows in Net Services with Low Runtime Overhead

“…The model in [14] offers functions to check intra-component information flows through the JIF language [35]. It also defines protocols to check inter-component information flows.…”

“…Models such as [12] belong to the first one, which fail to check information flows within a service and results in imprecise control. Models such as [14] belong to the second one. Although they are precise, they may induce large runtime overhead.…”

“…Our research focuses on preventing information leakage during the execution of net services. The prevention can be achieved by information flow control [2][3][4][5][6][7][8][9][10][11][12][13][14][15].…”