Dynamic Security Labels and Noninterference (Extended Abstract)

Abstract

This paper presents a language in which information flow is securely controlled by a type system, yet the security class of data can vary dynamically. Information flow policies provide the means to express strong security requirements for data confidentiality and integrity. Recent work on security-typed programming languages has shown that information flow can be analyzed statically, ensuring that programs will respect the restrictions placed on data. However, real computing systems have security policies that vary dynamically and that cannot be determined at the time of program analysis. For example, a file has associated access permissions that cannot be known with certainty until it is opened. Although one security-typed programming language has included support for dynamic security labels, there has been no demonstration that a general mechanism for dynamic labels can securely control information flow. In this paper, we present an expressive language-based mechanism for reasoning about dynamic security labels. The mechanism is formally presented in a core language based on the typed lambda calculus; any well-typed program in this language is provably secure because it satisfies noninterference.

Fable: A Language for Enforcing User-defined Security Policies

“…In the context of security, Zheng and Myers [46] formalize support for dynamic security labels that can be associated with data to express information flow policies. The technical machinery for associating labels to terms in their system is similar to ours.…”

“…To demonstrate FABLE's flexibility we have used it to encode a range of policies, including access control, static [32] and dynamic information flow [46] with forms of declassification [20], provenance tracking [7] and policies based on security automata [42]. In our experience, the soundness of FABLE makes proofs of security properties no more difficult-and arguably simpler-than proofs of similar properties in specialized languages [30,40,41].…”

Towards a practical secure concurrent language

“…If places are computed dynamically, then the choice of the place at which to execute a computation could be a covert channel, and would thus require the security analysis to track and control information flow through this channel. In this respect, first-class places are similar to firstclass security levels (e.g., [13,50]), and the security analysis could be extended to handle first-class places using similar techniques, such as dependent type systems.…”

Preventing Information Leaks through Shadow Executions

“…There are a few approaches [21,28,20] that employ a combination of static and dynamic methods to avoid the limitations of pure dynamic approaches. In both these works, the use of dynamic techniques is to expand the scope of the static analysis based policy enforcement mechanisms.…”