Hybrid Information Flow Analysis for Programs with Arrays

Barany, Gergö

doi:10.4204/eptcs.216.1

Cited by 2 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section we set the stage by describing the underlying Frama-C framework and the constraints and goals that inuenced our design. To make the paper self-contained, we also discuss the handling of various language constructs of C in our previous work [2,4].…”

Section: An Overview Of Secure Flowmentioning

confidence: 99%

“…We briey summarize the basics of the instrumentation done by Secure Flow. These operations follow the literature [19,2,1,4].…”

Section: Overview Of Information Flow Monitoringmentioning

confidence: 99%

“…Arrays introduce information ows from indices to any element the index may refer to [4]. The labels for distinct elements must therefore be shared; we use a single summary label arr_summary to model all elements of an array arr.…”

Section: Overview Of Information Flow Monitoringmentioning

confidence: 99%

“…The soundness of the program transformation relies on a static analysis in order to compute over-approximations of written memory locations in some pieces of code. Later Secure Flow was extended to arrays [4]. One benet of a transformation-based approach is that it lets end-users choose their verication techniques: they can verify all execution paths of the generated program by static analysis, or some individual paths by runtime verication, or even use a combination of both.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Hybrid Information Flow Analysis for Real-World C Code

Barany¹,

Signoles²

2017

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

International audienceInformation flow analysis models the propagation of data through a software system and identifies unintended information leaks. There is a wide range of such analyses, tracking flows statically, dynamically, or in a hybrid way combining both static and dynamic approaches. We present a hybrid information flow analysis for a large subset of the C programming language. Extending previous work that handled a few difficult features of C, our analysis can now deal with arrays, pointers with pointer arithmetic, structures, dynamic memory allocation, complex control flow, and statically resolvable indirect function calls. The analysis is implemented as a plugin to the Frama-C framework. We demonstrate the applicability and precision of our analyzer by applying it to an open-source cryptographic library. By combining abstract interpretation and monitoring techniques, we verify an information flow policy that proves the absence of control-flow based timing attacks against the implementations of many common cryptographic algorithms. Conversely, we demonstrate that our analysis is able to detect a known instance of this kind of vulnerability in another cryptographic primitive

show abstract

Section: An Overview Of Secure Flowmentioning

confidence: 99%

“…We briey summarize the basics of the instrumentation done by Secure Flow. These operations follow the literature [19,2,1,4].…”

Section: Overview Of Information Flow Monitoringmentioning

confidence: 99%

Section: Overview Of Information Flow Monitoringmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations