A Progress-Sensitive Flow-Sensitive Inlined Information-Flow Control Monitor

Abstract

We present a novel progress-sensitive, ow-sensitive hybrid information-ow control monitor for an imperative interactive language. Progress-sensitive information-ow control is a strong information security guarantee which ensures that a program's progress (or lack of) does not leak information. Flow-sensitivity means that this strong security guarantee is enforced fairly precisely: we track information ow according to the source of information and not to an a priori given variable security level. We illustrate our approach on an imperative interactive language. Our hybrid monitor is inlined: source programs are translated, by a type-based analysis, into a target language that supports dynamic security levels. A key benet of this is that the resulting monitored program is amenable to standard optimization techniques such as partial evaluation.

Beyond Labels: Permissiveness for Dynamic Information Flow Enforcement

“…If k-BNI(E, L, C) holds for every C, then E enforces k-BNI(L). 7 If for all k ≥ 0 and L, enforcer E satisfies k-BNI(L), then we say that E enforces BNI. Notice that, by definition, k-BNI ignores observations generated by infinite traces.…”

“…Here, context ctx of w := w and w := w is {x > 0}. Notice, if T i (w ) = T i (w ) holds prior to (7) for some i ≥ 0, then the value in T i (w) after the if command depends on ctx . Context ctx is prevented from leaking through T i (w) if we require that T (ctx ) T i+1 (w) holds, where T (ctx ) is the sensitivity of ctx .…”

“…Other hybrid flow-sensitive enforcement mechanisms (e.g., [14], [26]), which employ some static analysis during execution, do not satisfy BNI, either, because observations of blocked traces might only be a strict prefix of those generated by normally terminated traces, whereas BNI requires equality. There are enforcement mechanisms (e.g., [1], [7]) that satisfy BNI, but they either handle only L 2 or lose permissiveness by tagging variables with the same labels at the end of conditional commands independent of which branch is actually taken. We are not aware of an enforcement mechanism that uses label chains of length one, enforces labels from an arbitrary lattice, satisfies BNI, and is at least as permissive as 2-Enf .…”