Protecting Information under Dynamic Policies: Specification, Conditions and Enforcement

Doctoral thesis, 2016

Today, most of our valuable information is digital and processed by computer applications: cloud services store our pictures, apps on our smartphones update our contact lists, and web browsers access our bank accounts. Unfortunately, the security controls on this digital information are often more limited than we would like. If we want to allow our web browser to access our bank account and post on social networks, we can't prevent the browser from publishing our account's balance on Facebook. Information flow researchers have introduced various techniques that provide more fine-grained control on our digital data. This allows us to specify and enforce how we allow an application to process the information it has access too. In most existing work, we can only specify a single, non-changing security policy on our information. In practice however, we regularly change what information flows we do and do not want to allow. For example, we only want to share our pictures with social network contacts that are currently marked as friends. Or a company may only want to share its strategic plan with those employees who currently have a manager position. In this thesis we introduce support for such dynamic policies on our digital information. We discuss ways to specify these policies so that a computer can understand, update, and automatically enforce our security concerns.