Value-sensitive Hybrid Information Flow Control for a JavaScript-like Language
Paper in proceedings, 2015

Secure integration of third-party code is one of the prime challenges for securing today's web. Recent empirical studies give evidence of pervasive reliance on and excessive trust in third-party JavaScript, with no adequate security mechanism to limit the trust or the extent of its abuse. Information flow control is a promising approach for controlling the behavior of third-party code and enforcing confidentiality and integrity policies. While much progress has been made on static and dynamic approaches to information flow control, only recently their combinations have received attention. Purely static analysis falls short of addressing dynamic language features such as dynamic objects and dynamic code evaluation, while purely dynamic analysis suffers from inability to predict side effects in non-performed executions. This paper develops a value-sensitive hybrid mechanism for tracking information flow in a JavaScript-like language. The mechanism consists of a dynamic monitor empowered to invoke a static component on the fly. This enables us to achieve a sound yet permissive enforcement. We establish formal soundness results with respect to the security policy of noninterference. In addition, we demonstrate permissiveness by proving that we subsume the precision of purely static analysis and by presenting a collection of common programming patterns that indicate that our mechanism has potential to provide more permissiveness than dynamic mechanisms in practice.

information flow

language-based security

Author

Daniel Hedin

Chalmers, Computer Science and Engineering (Chalmers), Software Technology (Chalmers)

Luciano Bello

Chalmers, Computer Science and Engineering (Chalmers), Software Technology (Chalmers)

Andrei Sabelfeld

Chalmers, Computer Science and Engineering (Chalmers), Software Technology (Chalmers)

28th IEEE Computer Security Foundations Symposium, CSF 2015, Verona, Italy, 13-17 July

1063-6900 (ISSN)

Vol. 2015-September 351-365

Areas of Advance

Information and Communication Technology

Subject Categories

Computer and Information Science

Roots

Basic sciences

DOI

10.1109/CSF.2015.31

ISBN

978-146737538-2

More information

Created

10/8/2017