Safety versus Secrecy

Volpano, Dennis

doi:10.1007/3-540-48294-6_20

Cited by 49 publications

(55 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Secondly and more importantly, it sets a formal limit on how dynamic a monitor can be: if flow sensitivity is a desired feature in a monitor, then it should either include some static analysis or be more conservative than a type system. For instance, the monitors presented in [20], [50], [4], [43] cannot be adapted to be dynamic and more permissive than flow-sensitive type systems.…”

Section: Theorem 1 (Impossibility)mentioning

confidence: 99%

“…However, Fenton does not discuss soundness with respect to noninterference-like properties. Volpano [50] considers a purely dynamic monitor that only checks explicit flows. Implicit flows are allowed, and therefore the monitor does not enforce noninterference.…”

Section: Related Workmentioning

confidence: 99%

“…Another alternative is purely dynamic enforcement (e.g., [20], [50], [43], [4]), that performs dynamic security checks similar to the ones done by static analysis. For example, whenever there is a high variable on the righthand side of an assignment (tracking explicit flows) or in case the assignment appears inside of a high conditional or while loop (tracking implicit flows), then the assignment is only allowed in case the assigned variable is high.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Dynamic vs. Static Flow-Sensitive Security Analysis

Russo

Sabelfeld

2010

2010 23rd IEEE Computer Security Foundations Symposium

154

216

View full text Add to dashboard Cite

Abstract-This paper seeks to answer fundamental questions about trade-offs between static and dynamic security analysis. It has been previously shown that flow-sensitive static information-flow analysis is a natural generalization of flowinsensitive static analysis, which allows accepting more secure programs. It has been also shown that sound purely dynamic information-flow enforcement is more permissive than static analysis in the flow-insensitive case. We argue that the step from flow-insensitive to flow-sensitive is fundamentally limited for purely dynamic information-flow controls. We prove impossibility of a sound purely dynamic information-flow monitor that accepts programs certified by a classical flow-sensitive static analysis. A side implication is impossibility of permissive dynamic instrumented security semantics for information flow, which guides us to uncover an unsound semantics from the literature. We present a general framework for hybrid mechanisms that is parameterized in the static part and in the reaction method of the enforcement (stop, suppress, or rewrite) and give security guarantees with respect to terminationinsensitive noninterference for a simple language with output.

show abstract

Section: Theorem 1 (Impossibility)mentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Dynamic vs. Static Flow-Sensitive Security Analysis

Russo

Sabelfeld

2010

2010 23rd IEEE Computer Security Foundations Symposium

154

216

View full text Add to dashboard Cite

show abstract

“…Volpano [43] considers a purely dynamic monitor to prevent explicit flows. Implicit flows are allowed, and so the monitor does not enforce noninterference.…”

Section: Related Workmentioning

confidence: 99%

“…While the above tools are mostly based on static analysis, considerable progress has been also made on understanding monitoring for secure information flow [12,43,41,18,17,37,25,34,2,1]. Mozilla's ongoing project FlowSafe [9] aims at empowering Firefox with runtime information-flow tracking, where dynamic information-flow reference monitoring [2,3] lies at its core.…”

Section: Introductionmentioning

confidence: 99%

On-the-fly inlining of dynamic security monitors

Magazinius

Russo

Sabelfeld

2012

Computers & Security

View full text Add to dashboard Cite

Abstract. Language-based information-flow security considers programs that manipulate pieces of data at different sensitivity levels. Securing information flow in such programs remains an open challenge. Recently, considerable progress has been made on understanding dynamic monitoring for secure information flow. This paper presents a framework for inlining dynamic information-flow monitors. A novel feature of our framework is the ability to perform inlining on the fly. We consider a source language that includes dynamic code evaluation of strings whose content might not be known until runtime. To secure this construct, our inlining is done on the fly, at the string evaluation time, and, just like conventional offline inlining, requires no modification of the hosting runtime environment. We present a formalization for a simple language to show that the inlined code is secure: it satisfies a noninterference property. We also discuss practical considerations and preliminary experimental results.

show abstract

Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

Graa¹

2019

Cyber‐Vigilance and Digital Trust

View full text Add to dashboard Cite

Safety versus Secrecy

Cited by 49 publications

References 6 publications

Dynamic vs. Static Flow-Sensitive Security Analysis

Dynamic vs. Static Flow-Sensitive Security Analysis

On-the-fly inlining of dynamic security monitors

Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

Contact Info

Product

Resources

About