Optimising Faceted Secure Multi-Execution
Paper i proceeding, 2019

Language-Based Information Flow Control (IFC) provides strong security guarantees for untrusted code, but often suffers from a non-negligible rate of false alarms. Multi-execution based techniques promise to provide security guarantees without raising any false alarms. However, all known multi-execution approaches introduce extraneous performance overheads which are rarely studied. In this work, we lay down the foundations for optimisation techniques aimed at reducing these overheads to a managable level, thus helping to make multi-execution more practical. We characterise our optimisations as data-and control-oriented. Data-oriented optimisations reduce storage overheads- which also helps to remove unnecessary repeated computations. In contrast, computation-oriented optimisations rely on program annotations in order to reduce needless computation. These annotations motivate the need for a new, stronger, theoretical notion of transparency- i.e., a stronger notion for characterising the lack of false alarms. To show the efficacy of our optimisation techniques, we apply them to two case-studies: a secure (faceted) database and a chat server written in a multi-execution based IFC framework. Our case-studies clearly show that our optimisations significantly reduce the storage and computational overhead, sometimes from exponential to polynomial order. All of our formal results are accompanied by mechanised proofs in Agda.


Secure Multi-Execution

Faceted Values

Information Flow Control



Maximilian Algehed

Chalmers, Data- och informationsteknik, Funktionell programmering

Alejandro Russo

Chalmers, Data- och informationsteknik, Informationssäkerhet

Cormac Flanagan

University of California

Proceedings - IEEE Computer Security Foundations Symposium

19401434 (ISSN)

Vol. 2019-June 1-16 8823673
978-1-7281-1407-1 (ISBN)

2019 IEEE 32nd Computer Security Foundations Symposium (CSF)
Hoboken, NJ, USA,

WebSec: Säkerhet i webb-drivna system

Stiftelsen för Strategisk forskning (SSF) (RIT17-0011), 2018-03-01 -- 2023-02-28.

Octopi: Säker Programering för Sakernas Internet

Stiftelsen för Strategisk forskning (SSF) (RIT17-0023), 2018-03-01 -- 2023-02-28.


Data- och informationsvetenskap



Mer information

Senast uppdaterat