DMCA
Information-Flow Security for Interactive Programs
Cached
Download Links
- [www.cs.cornell.edu]
- [www.cs.cornell.edu]
- [www.cs.cornell.edu]
- DBLP
Other Repositories/Bibliography
| Citations: | 44 - 14 self |
BibTeX
@MISC{O'Neill_information-flowsecurity,
author = {Kevin R. O'Neill and Michael R. Clarkson and Stephen Chong},
title = {Information-Flow Security for Interactive Programs},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Interactive programs allow users to engage in input and output throughout execution. The ubiquity of such programs motivates the development of models for reasoning about their information-flow security, yet no such models seem to exist for imperative programming languages. Further, existing language-based security conditions founded on noninteractive models permit insecure information flows in interactive imperative programs. This paper formulates new strategybased information-flow security conditions for a simple imperative programming language that includes input and output operators. The semantics of the language enables a fine-grained approach to the resolution of nondeterministic choices. The security conditions leverage this approach to prohibit refinement attacks while still permitting observable nondeterminism. Extending the language with probabilistic choice yields a corresponding definition of probabilistic noninterference. A soundness theorem demonstrates the feasibility of statically enforcing the security conditions via a simple type system. These results constitute a step toward understanding and enforcing information-flow security in real-world programming languages, which include similar input and output operators.
Keyphrases
information-flow security interactive program security condition output operator language-based security condition nondeterministic choice interactive imperative program noninteractive model refinement attack simple type system simple imperative programming language fine-grained approach corresponding definition insecure information real-world programming language probabilistic noninterference soundness theorem probabilistic choice yield imperative programming language observable nondeterminism information-flow security condition similar input
