Skip to main content
SpringerLink
Log in

Information Flow Tracking for Side-Effectful Libraries

  • Conference paper
  • First Online:
Formal Techniques for Distributed Objects, Components, and Systems (FORTE 2018)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 10854))

Abstract

Dynamic information flow control is a promising technique for ensuring confidentiality and integrity of applications that manipulate sensitive information. While much progress has been made on increasingly powerful programming languages ranging from low-level machine languages to high-level languages for distributed systems, surprisingly little attention has been devoted to libraries and APIs. The state of the art is largely an all-or-nothing choice: either a shallow or deep library modeling approach. Seeking to break out of this restrictive choice, we formalize a general mechanism that tracks information flow for a language that includes higher-order functions, structured data types and references. A key feature of our approach is the model heap, a part of the memory, where security information is kept to enable the interaction between the labeled program and the unlabeled library. We provide a proof-of-concept implementation and report on experiments with a file system library. The system has been proved correct using Coq.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    For elegance of expression, when we write library in this paper we refer to both libraries and APIs.

  2. 2.

    In an operational semantics global non-constant values must be passed around during execution, similar to in a pure functional language.

References

  1. Austin, T.H., Flanagan, C.: Efficient purely-dynamic information flow analysis. In: PLAS (2009)

    Google Scholar 

  2. Bauer, L., Cai, S., Jia, L., Passaro, T., Stroucken, M., Tian, Y.: Run-time monitoring and formal analysis of information flows in chromium. In: NDSS. The Internet Society (2015)

    Google Scholar 

  3. Bichhawat, A., Rajani, V., Garg, D., Hammer, C.: Information flow control in WebKit’s JavaScript bytecode. In: Abadi, M., Kremer, S. (eds.) POST 2014. LNCS, vol. 8414, pp. 159–178. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-54792-8_9

    Chapter  Google Scholar 

  4. Bielova, N., Rezk, T.: A taxonomy of information flow monitors. In: Piessens, F., Viganò, L. (eds.) POST 2016. LNCS, vol. 9635, pp. 46–67. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49635-0_3

    Chapter  Google Scholar 

  5. Denning, D.E.: A lattice model of secure information flow. Commun. ACM 19(5), 236–243 (1976)

    Article  MathSciNet  Google Scholar 

  6. Devriese, D., Piessens, F.: Noninterference through secure multi-execution. In: S&P (2010)

    Google Scholar 

  7. Dimoulas, C., Findler, R.B., Flanagan, C., Felleisen, M.: Correct blame for contracts: no more scapegoating. In: POPL (2011)

    Google Scholar 

  8. Dimoulas, C., New, M.S., Findler, R.B., Felleisen, M.: Oh Lord, please don’t let contracts be misunderstood (functional pearl). In: ICFP (2016)

    Google Scholar 

  9. Findler, R.B., Felleisen, M.: Contracts for higher-order functions. In: ICFP (2002)

    Google Scholar 

  10. File System–Node.js v9.2.0 Documentation. https://nodejs.org/api/fs.html. Accessed Nov 2017

  11. Greenberg, M., Pierce, B.C., Weirich, S.: Contracts made manifest. In: POPL (2010)

    Google Scholar 

  12. Groef, W.D., Devriese, D., Nikiforakis, N., Piessens, F.: FlowFox: a web browser with flexible and precise information flow control. In: CCS (2012)

    Google Scholar 

  13. Groef, W.D., Devriese, D., Nikiforakis, N., Piessens, F.: Secure multi-execution of web scripts: theory and practice. J. Comput. Secur. 22, 469–509 (2014)

    Article  Google Scholar 

  14. Hedin, D., Bello, L., Sabelfeld, A.: Information-flow security for JavaScript and its APIs. J. Comput. Secur. 24, 181–234 (2015)

    Article  Google Scholar 

  15. Hedin, D., Birgisson, A., Bello, L., Sabelfeld, A.: JSFlow: tracking information flow in JavaScript and its APIs. In: SAC (2014)

    Google Scholar 

  16. Hedin, D., Sabelfeld, A.: Information-flow security for a core of JavaScript. In: CSF (2012)

    Google Scholar 

  17. Hedin, D., Sjösten, A., Piessens, F., Sabelfeld, A.: A principled approach to tracking information flow in the presence of libraries. In: Maffei, M., Ryan, M. (eds.) POST 2017. LNCS, vol. 10204, pp. 49–70. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-662-54455-6_3

    Chapter  Google Scholar 

  18. Heule, S., Stefan, D., Yang, E.Z., Mitchell, J.C., Russo, A.: IFC inside: retrofitting languages with dynamic information flow control. In: Focardi, R., Myers, A. (eds.) POST 2015. LNCS, vol. 9036, pp. 11–31. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46666-7_2

    Chapter  Google Scholar 

  19. INRIA: The Coq Proof Assistant. https://coq.inria.fr/. Accessed Nov 2017

  20. Kashyap, V., Wiedermann, B., Hardekopf, B.: Timing- and termination-sensitive secure information flow: exploring a new approach. In: S&P (2011)

    Google Scholar 

  21. King, D., Jaeger, T., Jha, S., Seshia, S.A.: Effective blame for information-flow violations. In: FSE (2008)

    Google Scholar 

  22. Mozilla Developer Network: Proxy. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Proxy. Accessed Mar 2018

  23. Mozilla Developer Network: RegExp. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp. Accessed Mar 2018

  24. Rafnsson, W., Sabelfeld, A.: Secure multi-execution: fine-grained, declassification-aware, and transparent. In: CSF (2013)

    Google Scholar 

  25. Sabelfeld, A., Myers, A.C.: Language-based information-flow security. IEEE J. Sel. Areas Commun. 21(1), 5–19 (2003)

    Article  Google Scholar 

  26. Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. Program Flow Analysis: Theory and Applications (1981)

    Google Scholar 

  27. Sjösten, A., Hedin, D., Sabelfeld, A.: Information Flow Tracking for Side-effectful Libraries - Full version. http://www.cse.chalmers.se/research/group/security/side-effectful-libraries/

  28. Zdancewic, S.A.: Programming languages for information security. Ph.D. thesis, Cornell University (2002)

    Google Scholar 

Download references

Acknowledgments

This work was partly funded by the Swedish Foundation for Strategic Research (SSF) and the Swedish Research Council (VR).

Author information

Authors and Affiliations

  1. Chalmers University of Technology, Gothenburg, Sweden

    Alexander Sjösten, Daniel Hedin & Andrei Sabelfeld

  2. Mälardalen University, Västerås, Sweden

    Daniel Hedin

Authors
  1. Alexander Sjösten
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Daniel Hedin
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Andrei Sabelfeld
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Alexander Sjösten .

Editor information

Editors and Affiliations

  1. Technische Universität Dresden, Dresden, Germany

    Christel Baier

  2. Departamento de Informática, Universidade Nova de Lisboa, Caparica, Portugal

    Luís Caires

Rights and permissions

Reprints and permissions

Copyright information

© 2018 IFIP International Federation for Information Processing

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Sjösten, A., Hedin, D., Sabelfeld, A. (2018). Information Flow Tracking for Side-Effectful Libraries. In: Baier, C., Caires, L. (eds) Formal Techniques for Distributed Objects, Components, and Systems. FORTE 2018. Lecture Notes in Computer Science(), vol 10854. Springer, Cham. https://doi.org/10.1007/978-3-319-92612-4_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-92612-4_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-92611-7

  • Online ISBN: 978-3-319-92612-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Societies and partnerships

Search

Navigation