Stateful Declassification Policies for Event-Driven Programs

Abstract

We propose a novel mechanism for enforcing information flow policies with support for declassification on event-driven programs. Declassification policies consist of two functions. First, a projection function specifies for each confidential event what information in the event can be declassified directly. This generalizes the traditional security labelling of inputs. Second, a stateful release function specifies the aggregate information about all confidential events seen so far that can be declassified. We provide evidence that such declassification policies are useful in the context of JavaScript web applications. An enforcement mechanism for our policies is presented and its soundness and precision is proven. Finally, we give evidence of practicality by implementing and evaluating the mechanism in a browser.

Non-interference with What-Declassification in Component-Based Systems

“…Vanhoef et al [15] provide a similar notion of declassification which allows declassification of partial information using a project function for specification. Vanhoef et al additionally allow the declassification of aggregated information over a history of events, making the declassification policy stateful.…”

Client Side Web Session Integrity as a Non-interference Property

“…These scenarios can be handled in our approach by means of endorsement (the integrity variant of declassification [24,28]). …”

Spot the Difference: Secure Multi-execution and Multiple Facets

“…Intuitively, time-sensitive noninterference is stronger than termination-sensitive noninterference because it requires that two executions starting in low-equal memories must terminate within the same number of program execution steps. Other works [10,20,26] have proposed other information flow properties, declassification properties, for modified SME monitors. We do not study in this work SME-based monitors for declassification.…”

“…The new monitor, that we call MF-TSNI, is not semantically equivalent to MFd-TSNI, and is not TSNI transparent. Both SME [10,20,26], and MF [4] have been extended to handle declassification, a security property more versatile than noninterference. It is left as future work to understand if our results generalize to declassification properties in order to compare SME and MF.…”