Exploring and enforcing security guarantees via program dependence graphs

Abstract

We present PIDGIN, a program analysis and understanding tool that enables the specification and enforcement of precise applicationspecific information security guarantees. PIDGIN also allows developers to interactively explore the information flows in their applications to develop policies and investigate counter-examples.PIDGIN combines program dependence graphs (PDGs), which precisely capture the information flows in a whole application, with a custom PDG query language. Queries express properties about the paths in the PDG; because paths in the PDG correspond to information flows in the application, queries can be used to specify global security policies.PIDGIN is scalable. Generating a PDG for a 330k line Java application takes 90 seconds, and checking a policy on that PDG takes under 14 seconds. The query language is expressive, supporting a large class of precise, application-specific security guarantees. Policies are separate from the code and do not interfere with testing or development, and can be used for security regression testing.We describe the design and implementation of PIDGIN and report on using it: (1) to explore information security guarantees in legacy programs; (2) to develop and modify security policies concurrently with application development; and (3) to develop policies based on known vulnerabilities.

Privacy and security constraints for code contributions

“…For this assessment, we consider the following open-source Java software projects hosted on GitHub: Gitblit, 9 Open Refine, 10 Voldemort, 11 ScribeJava, 12 Solo, 13 HikariCP, 14 Apache Kafka, 15 Teammates, 16 and Crawler4J. 17 These projects have at least 100 stars and 50 forks as well as many pull requests.…”

“…Additionally, some approaches allow developers to mitigate the significant effort issue, but they do not support code contribution analysis. 14,15 To reduce the discussed problems, we propose the Salvum policy language to support the specification of constraints that help to protect sensitive information from being inadvertently accessed by specific code contributions. For instance, Gitblit is a git repository manager that uses sensitive information such as password to its authentication mechanism.…”

JRIF: Reactive Information Flow Control for Java

“…Expressive structures, like automata, have previously been used to represent information flow specifications. Program dependence graphs [17,20], which represent data and flow dependencies between values specify allowable declassifications. And Rocha et al [31,32] employ policy graphs to specify sequences of functions that cause declassifications.…”

Saluki: Finding Taint-style Vulnerabilities with Static Property Checking

“…Query language approaches relate closely to the specification aspect of Saluki. Source-based approaches (e.g., by Yamaguchi et al [39,40], and tools such as PQL [26,28,29] and Pidgin [24] use taint-style patterns to find vulnerabilities. In general, binaries present unique challenges where we cannot exploit knowledge of source-level constructs (e.g., macros and objects).…”