AT-DIFC ⁺ : Toward Adaptive and Trust-Aware Decentralized Information Flow Control

Abstract

Modern software systems and their corresponding architectures are increasingly decentralized, distributed, and dynamic. As a consequence, decentralized mechanisms are required to ensure security in such architectures. Decentralized Information Flow Control (DIFC) is a mechanism to control information flow in distributed systems. This article presents and discusses several improvements to an adaptive decentralized information flow approach that incorporates trust for decentralized systems to provide security. Adaptive Trust-Aware Decentralized Information Flow (AT-DIFC + ) combines decentralized information flow control mechanisms, trust-based methods, and decentralized control architectures to control and enforce information flow in an open, decentralized system. We strengthen our approach against newly discovered attacks and provide additional information about its reconfiguration, decentralized control architectures, and reference implementation. We evaluate the effectiveness and performance of AT-DIFC + on two case studies and perform additional experiments and to gauge the mitigations’ effectiveness against the identified attacks.

A noninterference trusted dual system security guarantee method based on secure memory

“…If this problem cannot be solved, the security mechanism of the hardware is always flawed. Predecessors implemented the control mechanism of information flow on flume system, 25 which alleviated this problem through the operating system to a certain extent. However, these information flow control mechanisms need to redesign the operating system, and their application fields are too narrow to be suitable for a wide range of information scenarios.…”