Flow-Limited Authorization

Abstract

Enforcing the confidentiality and integrity of information is critical in distributed applications. Production systems typically use some form of authorization mechanism to protect information, but these mechanisms do not typically provide end-to-end information security guarantees. Information flow control mechanisms provide end-to-end security, but their guarantees break down when trust relationships may change dynamically, a common scenario in production environments. This dissertation presents flow-limited authorization, a new foundation for enforcing information security. Flow-limited authorization is an approach to authorization in that it can be used to reason about whether a principal is permitted to perform an action. It is an approach to information flow control in that it can be used to reason about whether a flow of information is secure.This dissertation presents the theoretical foundation of this approach, the FlowLimited Authorization Model (FLAM). FLAM uses a novel principal algebra that unifies authority and information flow policies and a logic for making secure authorization and information flow decisions. This logic ensures that such decisions cannot be influenced by attackers or leak confidential information.We embed the FLAM logic in a core programming model, the Flow-Limited Authorization Calculus (FLAC). FLAC programs selectively enable flows of information; the type system ensures that attackers cannot create unauthorized flows. A well-typed FLAC not only ensures proper authorization, but also secure information flow.The FLAC approach to secure programming is instantiated in FLAME, a library and to measure them, and how to build better abstractions based on them. Gün Sirer sparked my interest in decentralized systems and instilled in me an appreciation of clean, readable code. Fred Schneider reminds me that it is our job to explain, not our reader's job to understand; he has helped bring more clarity to many ideas in this dissertation.The graduate students at Cornell have also been a vital part of my time here. Cornell Ph.D. students excel at self-organization, and because of that I have never lacked for an opportunity to play frisbee, to "play" hockey, or to socialize with other graduate students. Aaron Rosenberg, from the English department, kept me sane with frequent squash games, along with good converstation about being old students and new dads. They are all both funny and intelligent, and it was a great pleasure bouncing ideas off of them, talking about topics from type theory to effective doorstop mechanisms, and reacting to the foul balls from the baseball field that occasionally hit our window.The students of the Applied Programming Languages group have been great col- There are also many people without whom I would likely not have made it to Cornell in the first place. My parents, Jamie and Celia Barnett, constantly supported my curiosity and growth and never let the fact we lived in a small town in Mississippi get in the way of that. They also overcame their initial electrica...

Nonmalleable Information Flow Control

“…Each example shows code that type-checks under existing informationflow type systems even though it contains insecure information flows, which we are able to characterize in a new way. These examples use the notation of the flow-limited authorization model (FLAM) [4], which offers an expressive way to state both information flow restrictions and authorization policies. However, the problems observed in these examples are not specific to FLAM; they arise in all previous information-flow models that support downgrading (e.g., [8,15,21,25,32,42,47]).…”

“…T now uses its authority to declassify both bids and send them to all parties. Since both bids have high integrity, this declassification is legal according to existing typing rules introduced to enforce (qualified) robust declassification [4,10,26].…”

Extensible access control with authorization contracts

“…For this purpose, we use an authorization logic [2] based on the Flow-Limited Authorization Model (FLAM) [5]. We briefly describe our logic, highlighting where it differs from FLAM.…”

“…Aura [20] and Fine [38] implement access control using proof-carrying authentication, where proofs of formulas in an authorization logic are used as capabilities [4]. Our access control logic is inspired by the Flow-Limited Authorization Model [5], which uses projections to describe attenuated authority without requiring additional constructs such as roles or groups.…”

“…Rule CLOSURE-LEFT shows that D ; r p ← D q holds when there is some principal s such that at the time of closure creation (i.e., with delegation set D ), s believed that p acted for q (premise D ; s p q), and moreover, right now (i.e., with delegation set D) principal r trusts principal To query whether a particular set of delegations satisfies an acts-for relation, we use a proof search algorithm adapted from FLAM [5]. We give examples of using delegations to implement different authorization mechanisms in Section 4.…”