Information-flow control for database-backed applications
Paper in proceedings, 2019

Securing database-backed applications requires tracking information across the application program and the database together, since securing each component in isolation may still result in an overall insecure system. Current research extends language-based techniques with models capturing the database's behavior. This research, however, relies on simplistic database models, which ignore security-relevant features that may leak sensitive information. We propose a novel security monitor for database-backed applications. Our monitor tracks fine-grained dependencies between variables and database tuples by leveraging database theory concepts like disclosure lattices and query determinacy. It also accounts for a realistic database model that supports security-critical constructs like triggers and dynamic policies. The monitor automatically synthesizes program-level code that replicates the behavior of database features like triggers, thereby tracking information flows inside the database. We also introduce symbolic tuples, an efficient approximation of dependency-tracking over disclosure lattices. We implement our monitor for Scala programs and demonstrate its effectiveness on four case studies.

Database backed applications

Disclosure lattices

Information flow control

Author

Marco Guarnieri

IMDEA Software Institute

Musard Balliu

Royal Institute of Technology (KTH)

Daniel Schoepe

Chalmers, Computer Science and Engineering (Chalmers), Information Security

David Basin

Swiss Federal Institute of Technology in Zürich (ETH)

Andrei Sabelfeld

Chalmers, Computer Science and Engineering (Chalmers), Information Security

Proceedings - 4th IEEE European Symposium on Security and Privacy, EURO S and P 2019

Vol. June 2019 79-94 8806751

4th IEEE European Symposium on Security and Privacy, EURO S and P 2019
Stockholm, Sweden,

WebSec: Securing Web-driven Systems

Swedish Foundation for Strategic Research (SSF), 2018-03-01 -- 2023-02-28.

PrinSec: Principled Security for Emerging Application Domains

Swedish Research Council (VR), 2019-01-01 -- 2022-12-31.

Subject Categories

Embedded Systems

Computer Science

Computer Systems

DOI

10.1109/EuroSP.2019.00016

More information

Latest update

11/20/2019