Information Flow Tracking for Side-Effectful Libraries
Paper in proceeding, 2018
confidentiality and integrity of applications that manipulate sensitive
information. While much progress has been made on increasingly powerful
programming languages ranging from low-level machine languages to high-level
languages for distributed systems, surprisingly little attention has been
devoted to libraries and APIs. The state of the art is largely an
all-or-nothing choice: either a shallow or deep library
modeling approach. Seeking to break out of this restrictive choice, we
formalize a general mechanism that tracks information flow for a language
that includes higher-order functions, structured data types and references.
A key feature of our approach is the model heap, a part of the
memory, where security information is kept to enable the interaction between
the labeled program and the unlabeled library. We provide a
proof-of-concept implementation and report on experiments with a file system
library. The system has been proved correct using Coq.
Side-effectful Libraries
Language-Based Security
Information Flow Control
Author
Alexander Sjösten
Chalmers, Computer Science and Engineering (Chalmers), Information Security
Daniel Hedin
Chalmers, Computer Science and Engineering (Chalmers), Information Security
Andrei Sabelfeld
Chalmers, Computer Science and Engineering (Chalmers), Information Security
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
03029743 (ISSN) 16113349 (eISSN)
Vol. 10854 LNCS 141-160978-3-319-92611-7 (ISBN)
Madrid, Spain,
Areas of Advance
Information and Communication Technology
Subject Categories
Computer and Information Science
DOI
10.1007/978-3-319-92612-4_8