Citation Context

... assigned security levels at the beginning of the execution and this assignment is kept unchanged during the execution). Fusion of static and dynamic techniques is becoming increasingly popular [28], =-=[45]-=-, [27], [49]. These techniques offer benefits of increasing permissiveness because more information on the actual execution trace is available at runtime, while keeping runtime overhead moderate as so...

Citation Context

... . As can be seen from above (the emphasis is ours), it appears to be suggested that dynamic checking alone is insufficient for security. Dynamic techniques for information flow are on the rise again =-=[25, 13, 21, 12, 24]-=- driven by the need for permissiveness in today’s dynamic applications. But they still involve nontrivial static checks for leaks related to control flow. In this light, it might be surprising that it...

Citation Context

...32], [35]. However, dynamic code evaluation has been out of reach for the mostly static techniques developed so far. Recently, several dynamic techniques for program security have emerged [44], [24], =-=[37]-=-, [23]. Yet they have two limitations: (i) they target restrictive noninterference [20] policies (stipulating that there should be no dependence of public outputs on secret inputs) and (ii) they do no...

Citation Context

...e type system. Russo and Sabelfeld [30] discuss the tradeoffs between static and dynamic analyses in some depth. Le Guernic et al. [17] dynamically examine code from branches not taken. Shroff et al. =-=[33]-=- use a purely-dynamic analysis to track variable dependencies and reject more insecure programs over time. Zdancewic [38] uses integrity labels to provide robust declassification. Askarov and Myers [2...

Citation Context

... the function preserves the informativeness of a by placing it inside of the monad Sec H. Recently, several approaches have been proposed to dynamically enforce non-interference (Guernic et al. 2006; =-=Shroff et al. 2007-=-; Nair et al. 2007). In order to be sound, these approaches still need to perform some static analysis prior to or at run-time. Authors argue, in one way or another, that their methods are more precis...

Citation Context

...onger than noninterference. Boudol shows how to enforce this safety property with a type system. A series of related work by Venkatakrishnan et al. [35], Le Guernic et al. [21, 20], and Shroff et al. =-=[32]-=- offer combinations of static and dynamic analysis for information flow in simple imperative languages. The language of Le Guernic [20] includes concurrency primitives. They prove that these analysis ...

Citation Context

...y proposed by Birgisson et al. [9]. Bracket annotations and upgrade instructions are in this respect very different from the oracles used by the early FIFC systems [23], [24], [36], [41], [45], [48], =-=[49]-=-, [55], since the soundness of these early systems crucially depended on the soundness of a static analysis tool providing information about the branches not taken. 14 2013-05-13The proof technique u...

Citation Context

...(execution and not program), its run-time nature and the monitoring mechanism used (a security automaton). Similar approaches lack formal proofs for the majority of them [13, 24] and miss concurrency =-=[11, 13, 22, 24]-=- (even † The author was partially supported by NSF grants CCR-0209205 and CCR-0296182. E-mail: Gurvan.Le_Guernic@irisa.fr if some claim they do). Dealing with concurrency is really tricky as shown by ...

Citation Context

...ava, ML, and Ada have emerged [28, 38, 39]. While the above tools are mostly based on static analysis, considerable progress has been also made on understanding monitoring for secure information flow =-=[12, 43, 41, 18, 17, 37, 25, 34, 2, 1]-=-. Mozilla’s ongoing project FlowSafe [9] aims at empowering Firefox with runtime information-flow tracking, where dynamic information-flow reference monitoring [2, 3] lies at its core. The driving for...