The Anatomy and Facets of Dynamic Policies

Broberg, Niklas; Delft, Bart van; Sands, David

doi:10.1109/csf.2015.16

Cited by 20 publications

(44 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One of the facets discussed in [5] is the distinction between "whitelisting flows" and "blacklisting flows", which is similar to our distinction between a permissive and a prohibitive reading of policies. Interestingly, the whitelisting/permissive reading is claimed to be the norm in the programming language security literature.…”

Section: Related Workmentioning

confidence: 84%

Dynamic intransitive noninterference revisited

Eggert

Meyden

2017

Form. Asp. Comput.

View full text Add to dashboard Cite

The paper studies dynamic information flow security policies in an automaton-based model. Two semantic interpretations of such policies are developed, both of which generalize the notion of TA-security [van der Meyden ESORICS 2007] for static intransitive noninterference policies. One of the interpretations focuses on information flows permitted by policy edges, the other focuses on prohibitions implied by absence of policy edges. In general, the two interpretations differ, but necessary and sufficient conditions are identified for the two interpretations to be equivalent. Sound and complete proof techniques are developed for both interpretations. Two applications of the theory are presented. The first is a general result showing that access control mechanisms are able to enforce a dynamic information flow policy. The second is a simple capability system motivated by the Flume operating system.

show abstract

Section: Related Workmentioning

confidence: 84%

Dynamic intransitive noninterference revisited

Eggert

Meyden

2017

Form. Asp. Comput.

View full text Add to dashboard Cite

show abstract

“…Since this is not the case, the program violates the security condition. In the terminology of facets of dynamic policies [6], the condition does not allow for the time-transitive flows that we desire.…”

Section: Relabeling Supportmentioning

confidence: 98%

Dynamic Enforcement of Dynamic Policies

Buiras

Delft

2015

Proceedings of the 10th ACM Workshop on Programming Languages and Analysis for Security

Self Cite

View full text Add to dashboard Cite

This paper presents SLIO, an information-flow control mechanism enforcing dynamic policies: security policies which change the relation between security levels while the system is running. SLIO builds on LIO, a floating-label information-flow control system embedded in Haskell that uses a runtime monitor to enforce security. We identify an implicit flow arising from the decision to change the policy based on sensitive information and introduce a corresponding check in the enforcement mechanism. We provide a formal security guarantee for SLIO, presented as a knowledgebased property, which specifies that observers can only learn information in accordance with the level ordering. Like LIO, SLIO is a generic enforcement mechanism, parametrised on the concrete instantiation of security labels and their policy change mechanism. To illustrate the applicability of our results, we implement well-known label models such as DLM, the Flowlocks framework, and DC labels in SLIO.

show abstract

“…We have proven that RIF automata enforce PWNI for a simple imperative language [22], giving us confidence in the formal guarantees enforced by the JRIF type system. 9 Many models [2,3,19,24,36] have been proposed for expressing and enforcing policies that permit changing the restrictions imposed on the use of values, but PWNI is the first to handle both classifications and deprecations.…”

Section: What Jrif Label Checking Enforcesmentioning

confidence: 99%

JRIF: Reactive Information Flow Control for Java

Kozyri

Arden

Myers

et al. 2019

Foundations of Security, Protocols, and Equational Reasoning

View full text Add to dashboard Cite

A reactive information flow (RIF) automaton for a value v specifies (i) allowed uses for v and (ii) the RIF automaton for any value that might be directly or indirectly derived from v. RIF automata thus specify how transforming a value alters how the result might be used. Such labels are more expressive than existing approaches for controlling downgrading. We devised a type system around RIF automata and incorporated it into Jif, a dialect of Java that supports a classic form of labels for information flow. By implementing a compiler for the resulting JRIF language, we demonstrate how easy it is to replace a classic information-flow type system by a more expressive RIF-based type system. We programmed two example applications in JRIF, and we discuss insights they provide into the benefits of RIF-based security labels.

show abstract

The Anatomy and Facets of Dynamic Policies

Cited by 20 publications

References 44 publications

Dynamic intransitive noninterference revisited

Dynamic intransitive noninterference revisited

Dynamic Enforcement of Dynamic Policies

JRIF: Reactive Information Flow Control for Java

Contact Info

Product

Resources

About