Tight Enforcement of Information-Release Policies for Dynamic Languages

被引：42

作者：

Askarov, Aslan ^{[1
]}

Sabelfeld, Andrei ^{[2
]}

机构：

[1] Cornell Univ, Dept Comp Sci, Ithaca, NY 14853 USA

[2] Chalmers Univ Technol, Dept Comp Sci & Engn, Gothenburg, Sweden

来源：

PROCEEDINGS OF THE 22ND IEEE COMPUTER SECURITY FOUNDATIONS SYMPOSIUM | 2009年

关键词：

DECLASSIFICATION;

D O I：

10.1109/CSF.2009.22

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

This paper studies the problem of securing information release in dynamic languages. We propose (i) an intuitive framework for information-release policies expressing both what can be released by an application and where in the code this release may take place and (ii) tight and modular enforcement by hybrid mechanisms that combine monitoring with on-the-fly static analysis for a language with dynamic code evaluation and communication primitives. The policy framework and enforcement mechanisms support both termination-sensitive and insensitive security policies.

引用

页码：43 / +

页数：3

共 44 条

[31] Dimensions and principles of declassification [J].

Sabelfeld, A ;

Sands, D .

18TH IEEE COMPUTER SECURITY FOUNDATIONS WORKSHOP, PROCEEDINGS, 2005, :255-269

[32]

Sabelfeld A, 2004, LECT NOTES COMPUT SC, V3233, P174

[33] Language-based information-flow security [J].

Sabelfeld, A ;

Myers, AC .

IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, 2003, 21 (01) :5-19

[34]

SABELFELD A, 2009, J COMPUTER IN PRESS

[35]

Sabelfeld A., 2009, LNCS

[36] Dynamic dependency monitoring to secure information flow [J].

Shroff, Paritosh ;

Smith, Scott F. ;

Thober, Mark .

20TH IEEE COMPUTER SECURITY FOUNDATIONS SYMPOSIUM (CSFS20), PROCEEDINGS, 2007, :203-+

[37]

SIMONET V, 2003, FLOW CAM SYSTEM SOFT

[38]

Smith S. F., 2006, PLAS 2006. Proceedings of the 2006 Programming Languages and Analysis for Security Workshop, P75, DOI 10.1145/1134744.1134758

[39] FABLE: A language for enforcing user-defined security policies [J].

Swamy, Nikhil ;

Corcoran, Brian J. ;

Hicks, Michael .

PROCEEDINGS OF THE 2008 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, 2008, :369-383

[40]

van der Meyden R, 2007, LECT NOTES COMPUT SC, V4734, P235

← 1 2 3 4 5 →