On Formalizing Information-Flow Control Libraries

Vassena, Marco; Russo, Alejandro

doi:10.1145/2993600.2993608

Cited by 10 publications

(13 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, when adding file operations, both fine-(e.g., [Broberg et al 2013]) and coarse-grained (e.g., [Efstathopoulos et al 2005;Krohn et al 2007;Russo et al 2009;Stefan et al 2011]) enforcements are likely to assign a single flow-insensitive label to each file in order to denote the sensitivity of its content. Then, those features could be handled flow-insensitively in both systems (e.g., Pottier and Simonet 2003;Stefan et al 2011;Vassena and Russo 2016]), in a manner similar to what we have just shown for references in…”

Section: Dynamicsmentioning

confidence: 91%

From fine- to coarse-grained dynamic information flow control and back

Vassena

Russo

Garg

et al. 2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

We show that fine-grained and coarse-grained dynamic information-flow control (IFC) systems are equally expressive. To this end, we mechanize two mostly standard languages, one with a fine-grained dynamic IFC system and the other with a coarse-grained dynamic IFC system, and prove a semantics-preserving translation from each language to the other. In addition, we derive the standard security property of non-interference of each language from that of the other, via our verified translation. This result addresses a longstanding open problem in IFC: whether coarse-grained dynamic IFC techniques are less expressive than fine-grained dynamic IFC techniques (they are not!). The translations also stand to have important implications on the usability of IFC approaches. The coarse-to fine-grained direction can be used to remove the label annotation burden that fine-grained systems impose on developers, while the fine-to coarse-grained translation shows that coarse-grained systemsÐwhich are easier to design and implementÐcan track information as precisely as fine-grained systems and provides an algorithm for automatically retrofitting legacy applications to run on existing coarse-grained systems. CCS Concepts: • Security and privacy → Formal security models;

show abstract

Section: Dynamicsmentioning

confidence: 91%

From fine- to coarse-grained dynamic information flow control and back

Vassena

Russo

Garg

et al. 2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

show abstract

“…While the technicalities of this technique and ours differ, both are based on the same core intuition. One advantage of the erasure technique is its applicability to non-terminating or partial programs in proofs of Termination Sensitive Noninterference and Progress Sensitive Noninterference [Vassena and Russo 2016]. We are unsure how well parametricity extends to this setting.…”

Section: Implementation In Haskellmentioning

confidence: 99%

Simple noninterference from parametricity

Algehed

Bernardy

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

In this paper we revisit the connection between parametricity and noninterference. Our primary contribution is a proof of noninterference for a polyvariant variation of the Dependency Core Calculus of Abadi et al. in the Calculus of Constructions. The proof is modular: it leverages parametricity for the Calculus of Constructionsand the encoding of data abstraction using existential types.This perspective gives rise to simple and understandable proofs of noninterference from parametricity. All our contributions have been mechanised in the Agda proof assistant.

show abstract

“…In Sect. 5.1, we describe our proof technique based on term erasure, which has been used to verify security guarantees of functional programming languages [30], IFC libraries [8,17,54,56,61], and an IFC runtime system [59]. In Sect.…”

Section: Security Guaranteesmentioning

confidence: 99%

Foundations for Parallel Information Flow Control Runtime Systems

Vassena

Soeller

Amidon

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We present the foundations for a new dynamic information flow control (IFC) parallel runtime system, LIOPAR. To our knowledge, LIOPAR is the first dynamic language-level IFC system to (1) support deterministic parallel thread execution and (2) eliminate both internaland external-timing covert channels that exploit the runtime system. Most existing IFC systems are vulnerable to external timing attacks because they are built atop vanilla runtime systems that do not account for security-these runtime systems allocate and reclaim shared resources (e.g., CPU-time and memory) fairly between threads at different security levels. While such attacks have largely been ignored-or, at best, mitigated-we demonstrate that extending IFC systems with parallelism leads to the internalization of these attacks. Our IFC runtime system design addresses these concerns by hierarchically managing resourcesboth CPU-time and memory-and making resource allocation and reclamation explicit at the language-level. We prove that LIOPAR is secure, i.e., it satisfies progress-and timing-sensitive non-interference, even when exposing clock and heap-statistics APIs.

show abstract

On Formalizing Information-Flow Control Libraries

Cited by 10 publications

References 26 publications

From fine- to coarse-grained dynamic information flow control and back

From fine- to coarse-grained dynamic information flow control and back

Simple noninterference from parametricity

Foundations for Parallel Information Flow Control Runtime Systems

Contact Info

Product

Resources

About