Language-based information-flow security

Abstract

Abstract-Current standard security practices do not provide substantial assurance that the end-to-end behavior of a computing system satisfies important security policies such as confidentiality. An end-to-end confidentiality policy might assert that secret input data cannot be inferred by an attacker through the attacker's observations of system output; this policy regulates information flow.Conventional security mechanisms such as access control and encryption do not directly address the enforcement of information-flow policies. Recently, a promising new approach has been developed: the use of programming-language techniques for specifying and enforcing information-flow policies. In this article we survey the past three decades of research on information-flow security, particularly focusing on work that uses static program analysis to enforce information-flow policies. We give a structured view of recent work in the area and identify some important open challenges.

Dynamic vs. Static Flow-Sensitive Security Analysis

“…We refer to a survey [42] for generally related work and focus on immediately related approaches to monitoring.…”

“…Information-flow controls offer a promising approach to security enforcement, where the goal is to prevent disclosure of sensitive data by applications [42]. Several informationflow tools have been developed for mainstream languages, e.g., Java-based Jif [35], Caml-based FlowCaml [46], and Ada-based SPARK Examiner [8], [11], as well as case studies [46], [3], [23], [13], [12], [15], [38].…”

“…One alternative to prevent explicit and implicit flows is purely static Denning-style enforcement [18], [52], [42]. For example, each assignment is checked for the following property: the level of the assigned variable must be high in case there is a high variable on the right-hand side of the assignment (tracking explicit flows) or in case the assignment appears inside of a high conditional or loop (tracking implicit flows).…”

“…Recall that Sabelfeld and Russo [43] have shown that while a purely dynamic information-flow monitor is more permissive than a Denning-style static information-flow analysis [52], both the monitor and the static analysis guarantee the same security property: termination-insensitive noninterference [52], [42], i.e., noninterference that ignores information flow related to the (non)termination behavior of the program.…”

Preface to the special issue on quantitative information flow

“…While there have been many efforts aimed at preventing improper flows completely (see for example, the survey by Sabelfeld and Myers (2003)), it has long been recognized that perfection is often impossible in practice. A basic example is a login program -whenever it rejects an incorrect password, it unavoidably reveals that the secret password differs from the one that was entered.…”