A Functional View of Imperative Information Flow

Austin, Thomas H.; Flanagan, Cormac; Abadi, Martı́n

doi:10.1007/978-3-642-35182-2_4

“…In SAFE [29,34] we follow a different approach, enforcing noninterference using purely dynamic checks, for arbitrary binaries in a custom-designed instruction set. The mechanisms we use for this are similar to those found in recent work on purely dynamic IFC for high-level languages [1,4,5,6,7,40,41,44,45,63,72,75,78,83,86]; however, as far as we know, we are the first to push these ideas to the lowest level.…”

Section: Related Workmentioning

confidence: 64%

“…Such tags representing IFC policies can involve arbitrary sets of principals, and principals themselves can be dynamically allocated to represent an unbounded number of entities within and outside the system. At the programming-language level, rich IFC policies have been extensively explored, with many proposed designs for static [43,67,68,73,77,96] and dynamic [4,5,6,7,40,44,72,75,78,86] enforcement mechanisms and a huge literature on their formal properties [43, 77, etc.]. Similarly, operating systems with information-flow tracking have been a staple of the OS literature for over a decade [36,54,55,66,97,97].…”

Section: Introductionmentioning

confidence: 99%

A verified information-flow architecture

Amorim

¹

,

Collins

²

,

DeHon

³

et al. 2016

JCS

View full text Add to dashboard Cite

SAFE is a clean-slate design for a highly secure computer system, with pervasive mechanisms for tracking and limiting information flows. At the lowest level, the SAFE hardware supports fine-grained programmable tags, with efficient and flexible propagation and combination of tags as instructions are executed. The operating system virtualizes these generic facilities to present an information-flow abstract machine that allows user programs to label sensitive data with rich confidentiality policies. We present a formal, machine-checked model of the key hardware and software mechanisms used to dynamically control information flow in SAFE and an end-to-end proof of noninterference for this model.We use a refinement proof methodology to propagate the noninterference property of the abstract machine down to the concrete machine level. We use an intermediate layer in the refinement chain that factors out the details of the information-flow control policy and devise a code generator for compiling such information-flow policies into low-level monitor code. Finally, we verify the correctness of this generator using a dedicated Hoare logic that abstracts from low-level machine instructions into a reusable set of verified structured code generators.

show abstract

“…In SAFE [29,34] we follow a different approach, enforcing noninterference using purely dynamic checks, for arbitrary binaries in a custom-designed instruction set. The mechanisms we use for this are similar to those found in recent work on purely dynamic IFC for high-level languages [1,4,5,6,7,40,41,44,45,63,72,75,78,83,86]; however, as far as we know, we are the first to push these ideas to the lowest level.…”

Section: Related Workmentioning

confidence: 64%

“…Such tags representing IFC policies can involve arbitrary sets of principals, and principals themselves can be dynamically allocated to represent an unbounded number of entities within and outside the system. At the programming-language level, rich IFC policies have been extensively explored, with many proposed designs for static [43,67,68,73,77,96] and dynamic [4,5,6,7,40,44,72,75,78,86] enforcement mechanisms and a huge literature on their formal properties [43, 77, etc.]. Similarly, operating systems with information-flow tracking have been a staple of the OS literature for over a decade [36,54,55,66,97,97].…”

Section: Introductionmentioning

confidence: 99%

A verified information-flow architecture

Amorim

¹

,

Collins

²

,

DeHon

³

et al. 2014

View full text Add to dashboard Cite

SAFE is a clean-slate design for a highly secure computer system, with pervasive mechanisms for tracking and limiting information flows. At the lowest level, the SAFE hardware supports fine-grained programmable tags, with efficient and flexible propagation and combination of tags as instructions are executed. The operating system virtualizes these generic facilities to present an information-flow abstract machine that allows user programs to label sensitive data with rich confidentiality policies. We present a formal, machine-checked model of the key hardware and software mechanisms used to dynamically control information flow in SAFE and an end-to-end proof of noninterference for this model.We use a refinement proof methodology to propagate the noninterference property of the abstract machine down to the concrete machine level. We use an intermediate layer in the refinement chain that factors out the details of the information-flow control policy and devise a code generator for compiling such information-flow policies into low-level monitor code. Finally, we verify the correctness of this generator using a dedicated Hoare logic that abstracts from low-level machine instructions into a reusable set of verified structured code generators.

show abstract

“…Flow-locks [5] extend information-flow typing with state-dependent conditions. Austin et al [34] describe dynamic IFC for imperative programs by translation to a lambda calculus. Secure multiexecution [35], [36] and faceted execution [37] are being explored as alternatives to monitoring by label-tracking.…”

Section: Related Workmentioning

confidence: 99%

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Chudnov

¹

,

Kuan²,

Naumann

³

2014

2014 IEEE 27th Computer Security Foundations Symposium

View full text Add to dashboard Cite

A number of systems have been developed for dynamic information flow control (IFC). In such systems, the security policy is expressed by labeling input and output channels; it is enforced by tracking and checking labels on data. Systems have been proven to enforce some form of noninterference (NI), formalized as a property of two runs of the program. In practice, NI is too strong and it is desirable to enforce some relaxation of NI that allows downgrading under constraints that have been classified as 'what', 'where', 'who', or 'when' policies. To encompass a broad range of policies, relational logic has been proposed as a means to specify and statically enforce policy. This paper shows how relational logic policies can be dynamically checked. To do so, we provide a new account of monitoring, in which the monitor state is viewed as an abstract interpretation of sets of pairs of program runs.

show abstract

A Functional View of Imperative Information Flow

Abstract: Abstract. We analyze dynamic information-flow control for imperative languages in terms of functional computation. Specifically, we translate an imperative language to a functional language, thus accounting for the main difficulties of information-flow control in the imperative language.

Cited by 6 publications

References 21 publications

A verified information-flow architecture

A verified information-flow architecture

A verified information-flow architecture

Information Flow Monitoring as Abstract Interpretation for Relational Logic

Contact Info

Product

Resources

About