Information-flow control for database-backed applications
Paper i proceeding, 2019

Securing database-backed applications requires tracking information across the application program and the database together, since securing each component in isolation may still result in an overall insecure system. Current research extends language-based techniques with models capturing the database's behavior. This research, however, relies on simplistic database models, which ignore security-relevant features that may leak sensitive information. We propose a novel security monitor for database-backed applications. Our monitor tracks fine-grained dependencies between variables and database tuples by leveraging database theory concepts like disclosure lattices and query determinacy. It also accounts for a realistic database model that supports security-critical constructs like triggers and dynamic policies. The monitor automatically synthesizes program-level code that replicates the behavior of database features like triggers, thereby tracking information flows inside the database. We also introduce symbolic tuples, an efficient approximation of dependency-tracking over disclosure lattices. We implement our monitor for Scala programs and demonstrate its effectiveness on four case studies.

Database backed applications

Disclosure lattices

Information flow control

Författare

Marco Guarnieri

IMDEA Software Institute

Musard Balliu

Kungliga Tekniska Högskolan (KTH)

Daniel Schoepe

Chalmers, Data- och informationsteknik, Informationssäkerhet

David Basin

Eidgenössische Technische Hochschule Zürich (ETH)

Andrei Sabelfeld

Chalmers, Data- och informationsteknik, Informationssäkerhet

Proceedings - 4th IEEE European Symposium on Security and Privacy, EURO S and P 2019

Vol. June 2019 79-94 8806751

4th IEEE European Symposium on Security and Privacy, EURO S and P 2019
Stockholm, Sweden,

WebSec: Säkerhet i webb-drivna system

Stiftelsen för Strategisk forskning (SSF), 2018-03-01 -- 2023-02-28.

Principiell säkerhet för framväxande applikationsdomäner

Vetenskapsrådet (VR), 2019-01-01 -- 2022-12-31.

Ämneskategorier

Inbäddad systemteknik

Datavetenskap (datalogi)

Datorsystem

DOI

10.1109/EuroSP.2019.00016

Mer information

Senast uppdaterat

2019-11-20