Boosting the Permissiveness of Dynamic Information-Flow Tracking by Testing

Abstract

Abstract. Tracking information flow in dynamic languages remains an open challenge. It might seem natural to address the challenge by runtime monitoring. However, there are well-known fundamental limits of dynamic flow-sensitive tracking of information flow, where paths not taken in a given execution contribute to information leaks. This paper shows how to overcome the permissiveness limit for dynamic analysis by a novel use of testing. We start with a program supervised by an informationflow monitor. The security of the execution is guaranteed by the monitor. Testing boosts the permissiveness of the monitor by discovering paths where the monitor raises security exceptions. Upon discovering a security error, the program is modified by injecting an annotation that prevents the same security exception on the next run of the program. The elegance of the approach is that it is sound no matter how much coverage is provided by the testing. Further, we show that when the mechanism has discovered the necessary annotations, then we have an accuracy guarantee: the results of monitoring a program are at least as accurate as flow-sensitive static analysis. We illustrate our approach for a simple imperative language with records and exceptions. Our experiments with the QuickCheck tool indicate that random testing accurately discovers annotations for a collection of scenarios with rich information flows.

Dependent Type Theory for Verification of Information Flow and Access Control Policies

“…This is in contrast to previous relational logics [Benton 2004;Yang 2007], which support reasoning only about programs with similar control flow, and provide inference rules for conditionals and loops with only low Boolean guards. The latter is known to be limiting in practice and prior work proposes workarounds through dynamic checks [Austin and Flanagan 2010] and testing [Birgisson et al 2012], but not statically.…”

ARMHEx: A hardware extension for DIFT on ARM-based SoCs

“…In order to overcome high time overheads of software solutions for DIFT (at least 300% [8]- [10]), hardware mechanisms were implemented. We can distinguish four main approaches: 1) Filtering hardware accelerator ( [11], [12]).…”

Information-Flow Security for a Core of JavaScript

“…Although they can be used as part of the programming language, in order to support legacy code it is more fruitful to view it as a way to incorporate the results of an automatic analysis. We have successfully experimented with the use of automatic black-box testing to inject the upgrade instructions [7]. The idea is to run a modified version of the type system on automatically generated test cases, and, whenever the type system stops the execution, the trace of the execution is inspected to find the place in the program where an upgrade instruction must be inserted.…”