Capabilities for information flow

Birgisson, Arnar; Russo, Alejandro; Sabelfeld, Andrei

doi:10.1145/2166956.2166961

Cited by 13 publications

(14 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This capability-like approach to authorizing downgrading enables our local declarative approach to restrict downgrading. Birgisson et al [4] use capabilities to restrict the ability to read and write memory locations, but do not consider the use of capabilities to restrict downgrading.…”

Section: Related Workmentioning

confidence: 99%

It’s My Privilege: Controlling Downgrading in DC-Labels

Waye

Buiras

King

et al. 2015

Security and Trust Management

Self Cite

View full text Add to dashboard Cite

Abstract. Disjunction Category Labels (DC-labels) are an expressive label format used to classify the sensitivity of data in information-flow control systems. DC-labels use capability-like privileges to downgrade information. Inappropriate use of privileges can compromise security, but DC-labels provide no mechanism to ensure appropriate use. We extend DC-labels with the novel notions of bounded privileges and robust privileges. Bounded privileges specify and enforce upper and lower bounds on the labels of data that may be downgraded. Bounded privileges are simple and intuitive, yet can express a rich set of desirable security policies. Robust privileges can be used only in downgrading operations that are robust, i.e., the code exercising privileges cannot be abused to release or certify more information than intended. Surprisingly, robust downgrades can be expressed in DC-labels as downgrading operations using a weakened privilege. We provide sound and complete run-time security checks to ensure downgrading operations are robust. We illustrate the applicability of bounded and robust privileges in a case study as well as by identifying a vulnerability in an existing DC-label-based application.

show abstract

Section: Related Workmentioning

confidence: 99%

It’s My Privilege: Controlling Downgrading in DC-Labels

Waye

Buiras

King

et al. 2015

Security and Trust Management

Self Cite

View full text Add to dashboard Cite

show abstract

“…Broberg and Sands [9] describe flow locks for dynamic information flow policies. Birgisson et al [8] show how capabilities can guarantee information flow policies. The system-level data flow framework Resin [49] allows the programmer to insert checking code to be executed at output channels.…”

Section: Related Workmentioning

confidence: 99%

Faceted execution of policy-agnostic programs

Austin

Yang

Flanagan

et al. 2013

Proceedings of the Eighth ACM SIGPLAN Workshop on Programming Languages and Analysis for Security

View full text Add to dashboard Cite

It is important for applications to protect sensitive data. Even for simple confidentiality and integrity policies, it is often difficult for programmers to reason about how the policies should interact and how to enforce policies across the program. A promising approach is policy-agnostic programming, a model that allows the programmer to implement policies separately from core functionality. Yang et al. describe Jeeves [48], a programming language that supports information flow policies describing how to reveal sensitive values in different output channels. Jeeves uses symbolic evaluation and constraint-solving to produce outputs adhering to the policies. This strategy provides strong confidentiality guarantees but limits expressiveness and implementation feasibility.We extend Jeeves with faceted values [6], which exploit the structure of sensitive values to yield both greater expressiveness and to facilitate reasoning about runtime behavior. We present a faceted semantics for Jeeves and describe a model for propagating multiple views of sensitive information through a program. We provide a proof of termination-insensitive non-interference and describe how the semantics facilitate reasoning about program behavior.

show abstract

“…A capability [13], fuses access to, and designation of, a protected resource into a single, unforgeable reference. The object capability security model [36] implements confinement [46], revocation, and multilevel security [37]; offers patterns for non-delegation [39]; resolves the problem of the Confused Deputy [12,28]; and is a base mechanism for information flow control [6,38]. The Emerald language [43] is an early example of an object-capability language.…”

Section: Related Workmentioning

confidence: 99%

Communication and Capability URLs in COAST-based Decentralized Services

Gorlick

Taylor

2013

REST: Advanced Research Topics and Practical Applications

View full text Add to dashboard Cite

Decentralized systems are systems-of-systems whose services are governed by two or more separate organizations under distinct spheres of authority. Coordinated evolution of the various elements of a decentralized system may be difficult, if not impossible, as individual organizations evolve their service offerings in response to organization-and service-specific pressures, including market demand, technology, competitive and cooperative interests, and funding. Consequently, decentralized services offer unique challenges for evolution and adaptation that reach well beyond any one single organizational boundary. However, client-driven service customization and tailoring is a powerful tool for meeting conflicting, independent client demands in an environment where disorderly and uneven service evolution predominates. Computational State Transfer (COAST) relies on capability security to minimize the risks of client-driven customization, for which fine-grain management of communication capability is critical. We introduce the Capability URL (CURL) as the unit of communication capability and show how two distinct mechanisms, communication capability and mobile code, can be combined to express and enforce constraints on the communications among decentralized computations.

show abstract

Capabilities for information flow

Cited by 13 publications

References 38 publications

It’s My Privilege: Controlling Downgrading in DC-Labels

It’s My Privilege: Controlling Downgrading in DC-Labels

Faceted execution of policy-agnostic programs

Communication and Capability URLs in COAST-based Decentralized Services

Contact Info

Product

Resources

About