Securing the Future — An Information Flow Analysis of a Distributed OO Language

Pettai, Martin; Laud, Peeter

doi:10.1007/978-3-642-27660-6_47

Cited by 1 publication

(2 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The typing rule for getting a future, checks that if a future variable is high, then the class is classified as unsafe. Alternatively, we could have used another sound static analysis, for instance (the relevant parts of) the static analysis defined for ABS in [64], and adapt it to our setting. We categorize safe and unsafe classes for the example in Fig.…”

Section: Iii41 Static Analysismentioning

confidence: 99%

“…Our approach is a dynamic technique, which is more permissive and precise and supports futures confidentiality. In [64], Pettai and Laud present a type system for ABS to ensure non-interference by means of over-approximation. E.g., a future's security level is the upper bound of the tasks' levels that the future refers to, while our run-time system does not use over-approximation (assuming the labels are exact).…”

Section: Ia Appendixmentioning

confidence: 99%

See 1 more Smart Citation

Information-Flow Control by Means of Security Wrappers for Active Object Languages with Futures

2021

View full text Add to dashboard Cite

In this thesis, we experiment with customizing programming languages to enforce privacy and security policies. We enforce privacy and security requirements at the level of a programming language when a program executes. We design a language and enrich it with the essential features to enforce the requirements. Moreover, we model our language with formal methods and prove that programs written in our language do not violate the desired policies. We design the language's syntax and semantics and formalize the operational semantics with mathematical logic, which enables us to reason about the language's properties.The structure of this thesis is described in the following. First, we introduce privacy and security policies that we want to enforce. We choose the GDPR (General Data Protection Regulation), which has strict requirements to protect the individual's privacy when processing personal data. For security, we give an overview of existing language-based techniques to preserve confidentiality and limit access to sensitive data. Second, we state the research questions that we want to handle in this thesis. Third, we introduce the tools and logic that we use for our research methods and modeling our languages. Finally, we present the research papers and relate the research questions to our contributions.The main contributions of this thesis are presented in three research papers. In the first paper, we introduce a programming language with provable guarantees that protects privacy and enforces the GDPR's requirements. The second paper gives an overview of a category of programming languages, called active object languages, that are used to develop distributed systems. In the third paper, we introduce a security mechanism to enforce security in active object languages. We discuss and prove that our language-based approaches are exact when it comes to enforcing policies and restrictions. Moreover, our approaches can be generalized to other languages.

show abstract

Section: Iii41 Static Analysismentioning

confidence: 99%

Section: Ia Appendixmentioning

confidence: 99%