Citation Context

... properties such as data confidentiality and integrity. Recent work has proposed a number of security-typed languages whose type systems statically check information flow, ranging from simple calculi =-=[28, 45, 17, 1, 38, 49, 41, 19, 18]-=- to full-featured languages [27, 50, 30, 4]. Many systems for which information security is important are concurrent—for example, web servers, databases, operating systems—yet the problem of checking ...

Citation Context

... analysis of run-time principals in terms of a typed #-calculus. This choice allows us to emphasize the new features of run-time principals and to use established proof techniques for noninterference =-=[14, 2, 25, 36]-=-. It should be possible to extend our results to Java-like languages by using the techniques of Banerjee and Naumann [6, 7]. The rest of the paper is organized as follows. The next section describes o...

Citation Context

...ent illegal implicit flows. Moreover, static information flow analysis incurs little run-time overhead. Recently, static information flow analyses have been formalized in security type systems (e.g., =-=[26, 10, 32, 18, 3, 20]-=-) that can provably enforce noninterference. Nevertheless, in most security-typed languages, security labels are purely static type-level information that cannot be accessed or tested at run time. 1sJ...

Citation Context

...t programs use information in accordance with its security class, and this approach has been instantiated in a number of languages in which the type system implements a similar static analysis (e.g., =-=[32, 15, 37, 26, 4, 28]-=-). These type systems are an attractive way to enforce security because they can be shown to enforce noninterference [13], a strong, end-to-end security property. For example, when applied to confiden...

Citation Context

...nal exit edges out of basic blocks. Without exceptions there is a unique edge out of a conditional which merges the two branches. Such control flow merge points play a crucial role for IFC in general =-=[57]-=-, because they mark the end of a high context (where some secrets have affected the control flow). For instance, brackets are only sound if ending brackets are control flow merge points, but standard ...

Citation Context

...ne Expressions e ::= n | !m | e1 + e2 Statements s ::= skip | m := e | s1; s2 | if e then s1 else s2 | while e do s Figure 1. Syntax of Aimp ify whether a program satisfies a noninterference property =-=[30, 11, 32]-=-. Since availability policies also correspond to a noninterference property in our security model, a static program analysis can be used to determine whether a system satisfies these policies. We now ...

Citation Context

...al methods). Caisson’s nested states have different semantics, as explained informally above and formally in §3. Nested states can also be seen as a concept dual to the notion of linear continuations =-=[16, 55]-=-. Whereas linear continuations identify code that is guaranteed to be executed afterwards by factoring the code out into a continuation, nested states identify code that is guaranteed to be executed b...

Citation Context

...tain information about the argument 1 by observing whether the execution of the program above terminates (there exists the return value) or not. The type system for information flow analysis of Myers =-=[18]-=- deals with global jump by introducing continuation for functional languages. Since a strong restriction is imposed on the usage of continuation in their type system, it is not obvious whether jump in...