The Experts below are selected from a list of 80733 Experts worldwide ranked by ideXlab platform
Alejandro Russo - One of the best experts on this subject based on the ideXlab platform.
-
from fine to coarse grained dynamic Information Flow Control and back
Symposium on Principles of Programming Languages, 2019Co-Authors: Marco Vassena, Alejandro Russo, Vineet Rajani, Deepak Garg, Deian StefanAbstract:We show that fine-grained and coarse-grained dynamic Information-Flow Control (IFC) systems are equally expressive. To this end, we mechanize two mostly standard languages, one with a fine-grained dynamic IFC system and the other with a coarse-grained dynamic IFC system, and prove a semantics-preserving translation from each language to the other. In addition, we derive the standard security property of non-interference of each language from that of the other, via our verified translation. This result addresses a longstanding open problem in IFC: whether coarse-grained dynamic IFC techniques are less expressive than fine-grained dynamic IFC techniques (they are not!). The translations also stand to have important implications on the usability of IFC approaches. The coarse- to fine-grained direction can be used to remove the label annotation burden that fine-grained systems impose on developers, while the fine- to coarse-grained translation shows that coarse-grained systems---which are easier to design and implement---can track Information as precisely as fine-grained systems and provides an algorithm for automatically retrofitting legacy applications to run on existing coarse-grained systems.
-
a better facet of dynamic Information Flow Control
The Web Conference, 2018Co-Authors: Minh Ngo, Alejandro Russo, Cormac Flanagan, Tamara Rezk, Nataliia Bielova, Thomas SchmitzAbstract:Multiple Facets (MF) is a dynamic enforcement mechanism which has proved to be a good fit for implementing Information Flow security for JavaScript. It relies on multi executing the program, once per each security level or view, to achieve soundness. By looking inside programs, MF encodes the views to reduce the number of needed multi-executions. In this work, we extend Multiple Facets in three directions. First, we propose a new version of MF for arbitrary lattices, called Generalised Multiple Facets, or GMF. GMF strictly generalizes MF, which was originally proposed for a specific lattice of principals. Second, we propose a new optimization on top of GMF that further reduces the number of executions. Third, we strengthen the security guarantees provided by Multiple Facets by proposing a termination sensitive version that eliminates covert channels due to termination.
-
MAC, A Verified Static Information-Flow Control Library
Journal of Logical and Algebraic Methods in Programming, 2018Co-Authors: Marco Vassena, Pablo Buiras, Alejandro Russo, Lucas WayeAbstract:The programming language Haskell plays a unique, privileged role in Information-Flow Control (IFC) research: it is able to enforce Information security via libraries. Many state-of-the-art IFC libraries (e.g., LIO and HLIO) support a variety of advanced features like mutable data structures, exceptions, and concurrency, whose subtle interaction makes verification of security guarantees challenging. In this work, we focus on MAC, a statically-enforced IFC library for Haskell. In MAC, like other IFC libraries, computations have a well-established algebraic structure for computations (i.e., monads) responsible to manipulate labeled values values coming from an abstract data type which associates a sensitivity label to a piece of Information. In this work, we enrich labeled values with a functor structure and provide an applicative functor operator which encourages a more functional programming style and simplifies code. Furthermore, we present a full-fledged, mechanically-verified model of MAC. Specifically, we show progress-insensitive noninterference for our sequential calculus and pinpoint sufficient requirements on the scheduler to prove progress-sensitive noninterference for our concurrent calculus. For that, we study the security guarantees of MAC using term erasure, a proof technique that ensures that the same public output should be produced if secrets are erased before or after program execution. As another contribution, we extend term erasure with two-steps erasure, a flexible novel technique that greatly simplifies the noninterference proof and helps to prove many advanced features of MAC.
-
cryptographically secure Information Flow Control on key value stores
arXiv: Cryptography and Security, 2017Co-Authors: Lucas Waye, Owen Arden, Pablo Buiras, Alejandro Russo, Stephen ChongAbstract:We present Clio, an Information Flow Control (IFC) system that transparently incorporates cryptography to enforce confidentiality and integrity policies on untrusted storage. Clio insulates developers from explicitly manipulating keys and cryptographic primitives by leveraging the policy language of the IFC system to automatically use the appropriate keys and correct cryptographic operations. We prove that Clio is secure with a novel proof technique that is based on a proof style from cryptography together with standard programming languages results. We present a prototype Clio implementation and a case study that demonstrates Clio's practicality.
-
flexible manipulation of labeled values for Information Flow Control libraries
European Symposium on Research in Computer Security, 2016Co-Authors: Marco Vassena, Pablo Buiras, Lucas Waye, Alejandro RussoAbstract:The programming language Haskell plays a unique, privileged role in Information-Flow Control (IFC) research: it is able to enforce Information security via libraries. Many state-of-the-art libraries (e.g., LIO, HLIO, and MAC) allow computations to manipulate data with different security labels by introducing the notion of labeled values, which protect values with explicit labels by means of an abstract data type. While computations have an underlying algebraic structure in such libraries (i.e. monads), there is no research on structures for labeled values and their impact on the programming model. In this paper, we add the functor structure to labeled values, which allows programmers to conveniently and securely perform computations without side-effects on such values, and an applicative operator, which extends this feature to work on multiple labeled values combined by a multi-parameter function. This functionality simplifies code, as it does not force programmers to spawn threads to manipulate sensitive data with side-effect free operations. Additionally, we present a relabel primitive which securely modifies the label of labeled values. This operation also helps to simplify code when aggregating data with heterogeneous labels, as it does not require spawning threads to do so. We provide mechanized proofs of the soundness our contributions for the security library MAC, although we remark that our ideas apply to LIO and HLIO as well.
Andrew C. Myers - One of the best experts on this subject based on the ideXlab platform.
-
secure autonomous cyber physical systems through verifiable Information Flow Control
Workshop on Cyber-Physical Systems, 2018Co-Authors: Jed Liu, Andrew C. Myers, Joe Corbettdavies, Andrew Ferraiuolo, Alexander Ivanov, Mulong Luo, Edward G Suh, Mark CampbellAbstract:Modern cyber-physical systems are complex networked computing systems that electronically Control physical systems. Autonomous road vehicles are an important and increasingly ubiquitous instance. Unfortunately, their increasing complexity often leads to security vulnerabilities. Network connectivity exposes these vulnerable systems to remote software attacks that can result in real-world physical damage, including vehicle crashes and loss of Control authority. We introduce an integrated architecture to provide provable security and safety assurance for cyber-physical systems by ensuring that safety-critical operations and Control cannot be unintentionally affected by potentially malicious parts of the system. Fine-grained Information Flow Control is used to design both hardware and software, determining how low-integrity Information can affect high-integrity Control decisions. This security assurance is used to improve end-to-end security across the entire cyber-physical system. We demonstrate this integrated approach by developing a mobile robotic testbed modeling a self-driving system and testing it with a malicious attack.
-
nonmalleable Information Flow Control
Computer and Communications Security, 2017Co-Authors: Ethan Cecchetti, Andrew C. Myers, Owen ArdenAbstract:Noninterference is a popular semantic security condition because it offers strong end-to-end guarantees, it is inherently compositional, and it can be enforced using a simple security type system. Unfortunately, it is too restrictive for real systems. Mechanisms for downgrading Information are needed to capture real-world security requirements, but downgrading eliminates the strong compositional security guarantees of noninterference. We introduce nonmalleable Information Flow, a new formal security condition that generalizes noninterference to permit Controlled downgrading of both confidentiality and integrity. While previous work on robust declassification prevents adversaries from exploiting the downgrading of confidentiality, our key insight is transparent endorsement, a mechanism for downgrading integrity while defending against adversarial exploitation. Robust declassification appeared to break the duality of confidentiality and integrity by making confidentiality depend on integrity, but transparent endorsement makes integrity depend on confidentiality, restoring this duality. We show how to extend a security-typed programming language with transparent endorsement and prove that this static type system enforces nonmalleable Information Flow, a new security property that subsumes robust declassification and transparent endorsement. Finally, we describe an implementation of this type system in the context of Flame, a Flow-limited authorization plugin for the Glasgow Haskell Compiler.
-
jrif reactive Information Flow Control for java
Foundations of Security Protocols and Equational Reasoning, 2016Co-Authors: Elisavet Kozyri, Owen Arden, Andrew C. Myers, Fred B SchneiderAbstract:Supported in part by AFOSR grants F9550-06-0019 and FA9550-11-1-0137, National Science Foundation grants 0430161, 0964409, and CCF-0424422 (TRUST), ONR grants N00014-01- 1-0968 and N00014-09-1-0652, and grants from Microsoft.
-
General Terms
2012Co-Authors: Lantian Zheng, Google Inc, Andrew C. MyersAbstract:This paper proposes a nonintrusive encryption mechanism for protecting data confidentiality on the Web. The core idea is to encrypt confidential data before sending it to untrusted sites and use keystores on the Web to manage encryption keys without intervention from users. A formal language-based Information Flow model is used to prove the soundness of the mechanism. Categories and Subject Descriptors D.4.6 [Security and Protection]: Cryptographic Controls; Information Flow Control
-
Sharing mobile code securely with Information Flow Control
Proceedings - IEEE Symposium on Security and Privacy, 2012Co-Authors: Owen Arden, Aslan Askarov, K. Vikram, Jed Liu, Michael D George, Andrew C. MyersAbstract:Mobile code is now a nearly inescapable component of modern computing, thanks to client-side code that runs within web browsers. The usual tension between security and functionality is particularly acute in a mobile-code setting, and current platforms disappoint on both dimensions. We introduce a new architecture for secure mobile code, with which developers can use, publish, and share mobile code securely across trust domains. This architecture enables new kinds of distributed applications, and makes it easier to reuse and evolve code from untrusted providers. The architecture gives mobile code considerable expressive power: it can securely access distributed, persistent, shared Information from multiple trust domains, unlike web applications bound by the same-origin policy. The core of our approach is analyzing how Flows of Information within mobile code affect confidentiality and integrity. Because mobile code is untrusted, this analysis requires novel constraints on Information Flow and authority. We show that these constraints offer principled enforcement of strong security while avoiding the limitations of current mobile-code security mechanisms. We evaluate our approach by demonstrating a variety of mobile-code applications, showing that new functionality can be offered along with strong security.
Stephen Chong - One of the best experts on this subject based on the ideXlab platform.
-
co inFlow coarse grained Information Flow Control for java like languages
IEEE Symposium on Security and Privacy, 2021Co-Authors: Jian Xiang, Stephen ChongAbstract:Coarse-grained dynamic Information-Flow Control (IFC) is a good match for imperative object-oriented programming languages such as Java. Java language abstractions align well with coarse-grained IFC concepts, and so Java can be cleanly extended with coarse-grained dynamic IFC without requiring significantly different design patterns or excessive security annotations, and without excessive performance overhead.We present Co-InFlow: an extension of Java with coarse-grained dynamic IFC. By careful design choices and defaults, a programmer typically needs to add very few annotations to a Java program to convert it to a Co-InFlow program with relatively good precision. Additional annotations can improve precision. We achieve this tradeoff between precision and annotation burden by instantiating and specializing recent advances in coarse-grained IFC for a Java-like setting, and by using opaque labeled values: a restriction of labeled values that the Co-InFlow runtime automatically and securely creates and uses.We have captured the essence of Co-InFlow in a middle-weight imperative calculus, and proven that it provides a termination- insensitive non-interference security guarantee. We have a prototype implementation of Co-InFlow and use it to evaluate the precision, usability, and potential performance of Co-InFlow.
-
Information Flow Control for distributed trusted execution environments
IEEE Computer Security Foundations Symposium, 2019Co-Authors: Anitha Gollamudi, Stephen Chong, Owen ArdenAbstract:Distributed applications cannot assume that their security policies will be enforced on untrusted hosts. Trusted execution environments (TEEs) combined with cryptographic mechanisms enable execution of known code on an untrusted host and the exchange of confidential and authenticated messages with it. TEEs do not, however, establish the trustworthiness of code executing in a TEE. Thus, developing secure applications using TEEs requires specialized expertise and careful auditing. This paper presents DFLATE, a core security calculus for distributed applications with TEEs. DFLATE offers high-level abstractions that reflect both the guarantees and limitations of the underlying security mechanisms they are based on. The accuracy of these abstractions is exhibited by asymmetry between confidentiality and integrity in our formal results: DFLATE enforces a strong form of noninterference for confidentiality, but only a weak form for integrity. This reflects the asymmetry of the security guarantees of a TEE: a malicious host cannot access secrets in the TEE or modify its contents, but they can suppress or manipulate the sequence of its inputs and outputs. Therefore DFLATE cannot protect against the suppression of high-integrity messages, but when these messages are delivered, their contents cannot have been influenced by an attacker.
-
A progress-sensitive Flow-sensitive inlined Information-Flow Control monitor (extended version)
Computers & Security, 2017Co-Authors: Andrew Bedford, Stephen Chong, Josée Desharnais, Elisavet Kozyri, Nadia TawbiAbstract:We present a novel progress-sensitive, Flow-sensitive hybrid Information-Flow Control monitor for an imperative interactive language. Progress-sensitive Information-Flow Control is a strong Information security guarantee which ensures that a program's progress (or lack of) does not leak Information. Flow-sensitivity means that this strong security guarantee is enforced fairly precisely: our monitor tracks Information Flow per variable and per program point. We illustrate our approach on an imperative interactive language. Our hybrid monitor is inlined: source programs are translated, by a type-based analysis, into a target language that supports dynamic security levels. A key benefit of this is that the resulting monitored program is amenable to standard optimization techniques such as partial evaluation. One of the distinguishing features of our hybrid monitor is that it uses sets of levels to track the different possible security types of variables. This feature allows us to distinguish outputs that never leak Information from those that may leak Information.
-
cryptographically secure Information Flow Control on key value stores
arXiv: Cryptography and Security, 2017Co-Authors: Lucas Waye, Owen Arden, Pablo Buiras, Alejandro Russo, Stephen ChongAbstract:We present Clio, an Information Flow Control (IFC) system that transparently incorporates cryptography to enforce confidentiality and integrity policies on untrusted storage. Clio insulates developers from explicitly manipulating keys and cryptographic primitives by leveraging the policy language of the IFC system to automatically use the appropriate keys and correct cryptographic operations. We prove that Clio is secure with a novel proof technique that is based on a proof style from cryptography together with standard programming languages results. We present a prototype Clio implementation and a case study that demonstrates Clio's practicality.
-
A Progress-Sensitive Flow-Sensitive Inlined Information-Flow Control Monitor
2016Co-Authors: Andrew Bedford, Stephen Chong, Josée Desharnais, Nadia TawbiAbstract:We present a novel progress-sensitive, Flow-sensitive hybrid Information-Flow Control monitor for an imperative interactive language. Progress-sensitive Information-Flow Control is a strong Information security guarantee which ensures that a program’s progress (or lack of) does not leak Information. Flow-sensitivity means that this strong security guarantee is enforced fairly precisely: we track Information Flow according to the source of Information and not to an a priori given variable security level. We illustrate our approach on an imperative interactive language. Our hybrid monitor is inlined: source programs are translated, by a type-based analysis, into a target language that supports dynamic security levels. A key benefit of this is that the resulting monitored program is amenable to standard optimization techniques such as partial evaluation.
Deian Stefan - One of the best experts on this subject based on the ideXlab platform.
-
foundations for parallel Information Flow Control runtime systems
Principles of Security and Trust, 2019Co-Authors: Marco Vassena, Gary Soeller, Peter Amidon, Matthew Chan, John Renner, Deian StefanAbstract:We present the foundations for a new dynamic Information Flow Control (IFC) parallel runtime system, LIO\(_{\mathrm {PAR}}\). To our knowledge, LIO\(_{\mathrm {PAR}}\) is the first dynamic language-level IFC system to (1) support deterministic parallel thread execution and (2) eliminate both internal- and external-timing covert channels that exploit the runtime system. Most existing IFC systems are vulnerable to external timing attacks because they are built atop vanilla runtime systems that do not account for security—these runtime systems allocate and reclaim shared resources (e.g., CPU-time and memory) fairly between threads at different security levels. While such attacks have largely been ignored—or, at best, mitigated—we demonstrate that extending IFC systems with parallelism leads to the internalization of these attacks. Our IFC runtime system design addresses these concerns by hierarchically managing resources—both CPU-time and memory—and making resource allocation and reclamation explicit at the language-level. We prove that LIO\(_{\mathrm {PAR}}\) is secure, i.e., it satisfies progress- and timing-sensitive non-interference, even when exposing clock and heap-statistics APIs.
-
from fine to coarse grained dynamic Information Flow Control and back
Symposium on Principles of Programming Languages, 2019Co-Authors: Marco Vassena, Alejandro Russo, Vineet Rajani, Deepak Garg, Deian StefanAbstract:We show that fine-grained and coarse-grained dynamic Information-Flow Control (IFC) systems are equally expressive. To this end, we mechanize two mostly standard languages, one with a fine-grained dynamic IFC system and the other with a coarse-grained dynamic IFC system, and prove a semantics-preserving translation from each language to the other. In addition, we derive the standard security property of non-interference of each language from that of the other, via our verified translation. This result addresses a longstanding open problem in IFC: whether coarse-grained dynamic IFC techniques are less expressive than fine-grained dynamic IFC techniques (they are not!). The translations also stand to have important implications on the usability of IFC approaches. The coarse- to fine-grained direction can be used to remove the label annotation burden that fine-grained systems impose on developers, while the fine- to coarse-grained translation shows that coarse-grained systems---which are easier to design and implement---can track Information as precisely as fine-grained systems and provides an algorithm for automatically retrofitting legacy applications to run on existing coarse-grained systems.
-
ifc inside retrofitting languages with dynamic Information Flow Control
Principles of Security and Trust, 2015Co-Authors: Stefan Heule, Deian Stefan, Edward Yang, John C Mitchell, Alejandro RussoAbstract:Many important security problems in JavaScript, such as browser extension security, untrusted JavaScript libraries and safe integration of mutually distrustful websites mash-ups, may be effectively addressed using an efficient implementation of Information Flow Control IFC. Unfortunately existing fine-grained approaches to JavaScript IFC require modifications to the language semantics and its engine, a non-goal for browser applications. In this work, we take the ideas of coarse-grained dynamic IFC and provide the theoretical foundation for a language-based approach that can be applied to any programming language for which external effects can be Controlled. We then apply this formalism to server- and client-side JavaScript, show how it generalizes to the C programming language, and connect it to the Haskell LIO system. Our methodology offers design principles for the construction of Information Flow Control systems when isolation can easily be achieved, as well as compositional proofs for optimized concrete implementations of these systems, by relating them to their isolated variants.
-
IFC Inside: Retrofitting Languages with Dynamic Information Flow Control (Extended Version)
arXiv: Programming Languages, 2015Co-Authors: Stefan Heule, Deian Stefan, Edward Yang, John C Mitchell, Alejandro RussoAbstract:Many important security problems in JavaScript, such as browser extension security, untrusted JavaScript libraries and safe integration of mutually distrustful websites (mash-ups), may be effectively addressed using an efficient implementation of Information Flow Control (IFC). Unfortunately existing fine-grained approaches to JavaScript IFC require modifications to the language semantics and its engine, a non-goal for browser applications. In this work, we take the ideas of coarse-grained dynamic IFC and provide the theoretical foundation for a language-based approach that can be applied to any programming language for which external effects can be Controlled. We then apply this formalism to server- and client-side JavaScript, show how it generalizes to the C programming language, and connect it to the Haskell LIO system. Our methodology offers design principles for the construction of Information Flow Control systems when isolation can easily be achieved, as well as compositional proofs for optimized concrete implementations of these systems, by relating them to their isolated variants.
-
addressing covert termination and timing channels in concurrent Information Flow systems
International Conference on Functional Programming, 2012Co-Authors: Deian Stefan, Pablo Buiras, Alejandro Russo, John C Mitchell, Amit Levy, David MazièresAbstract:When termination of a program is observable by an adversary, confidential Information may be leaked by terminating accordingly. While this termination covert channel has limited bandwidth for sequential programs, it is a more dangerous source of Information leakage in concurrent settings. We address concurrent termination and timing channels by presenting a dynamic Information-Flow Control system that mitigates and eliminates these channels while allowing termination and timing to depend on secret values. Intuitively, we leverage concurrency by placing such potentially sensitive actions in separate threads. While termination and timing of these threads may expose secret values, our system requires any thread observing these properties to raise its Information-Flow label accordingly, preventing leaks to lower-labeled contexts. We implement this approach in a Haskell library and demonstrate its applicability by building a web server that uses Information-Flow Control to restrict untrusted web applications.
Makoto Takizawa - One of the best experts on this subject based on the ideXlab platform.
-
capability based Information Flow Control model in the iot
Innovative Mobile and Internet Services in Ubiquitous Computing, 2019Co-Authors: Shigenari Nakamura, Tomoya Enokido, Leonard Barolli, Makoto TakizawaAbstract:Various types and huge number of nodes including not only computers like servers but also devices like sensors and actuators are interconnected in the IoT (Internet of Things). Here, the CapBAC (Capability-Based Access Control) model is proposed in the IoT system. In the CapBAC model, an owner of a device issues a capability token, i.e. a set of access rights to a subject. Here, the subject is allowed to manipulate the device according to the access rights in the capability token. In the IoT, a subject \(sb_i\) can get the data of the device \(d_1\) from another device \(d_2\) to which the data of the device \(d_1\) is brought although the subject \(sb_i\) is not allowed to get the data from the device \(d_1\). Here, the data in the device \(d_1\) illegal Flows to the subject \(sb_i\). In this paper, first, we newly define Information Flow relations among devices based on the CapBAC model. Next, we newly propose an OI (Operation Interruption) protocol to prevent illegal Information Flow in the IoT based on the Information Flow relations among devices. In the OI protocol, an operation to imply illegal Information Flow is interrupted.
-
object based Information Flow Control model in p2pps systems
Network-Based Information Systems, 2018Co-Authors: Shigenari Nakamura, Tomoya Enokido, Makoto TakizawaAbstract:In the P2PPS (P2P (peer-to-peer) type of topic-based PS (publish/subscribe)) model, each peer process (peer) publishes and subscribes event messages which are characterized by topics with no centralized coordinator. An illegal Information Flow occurs if an event message \(e_j\) published by a peer \(p_j\) carries Information on some topics into the peer \(p_i\), which the target peer \(p_i\) is not allowed to subscribe. In our previous studies, the SBS, TBS, and FS-H protocols are proposed to prevent illegal Information Flow among peers by banning event messages. In the protocols, the number of topics kept in every peer monotonically increases. Hence, most of the event messages are banned. In this paper, we newly consider the P2PPSO (P2PPS with object concept) model where the number of topics kept in every peer increases and decreases each time objects obtained by every peer are updated. In order to prevent illegal Information Flow from occurring in the P2PPSO system, we newly propose a TOBS (topics of objects-based synchronization) and TSOBS (topics and states of objects-based synchronization) protocols. In the TOBS protocol, it is simpler to detect illegal Information Flow than the TSOBS protocol. On the other hand, the fewer number of event messages are banned in the TSOBS protocol than the TOBS protocol.
-
Information Flow Control models in peer to peer publish subscribe systems
Complex Intelligent and Software Intensive Systems, 2016Co-Authors: Shigenari Nakamura, Tomoya Enokido, Makoto TakizawaAbstract:A publish/subscribe (PS) model is an event-driven model of a distributed system. In this paper, we consider a peer-to-peer (P2P) type of PS model where each peer (process) can publish and subscribe events. Here, a peer publishes an event message and then the event message is notified to a target peer which is interested in the event. Publications and subscriptions are specified in terms of topics as discussed in topic-based PS systems. In this paper, we newly discuss a topic-based access Control (TBAC) model to prevent illegal Information Flow among peers in PS systems. Here, an access right is a pair "t, op" of a topic t and an operation op which is publish or subscribe. A peer is allowed to publish an event message with topics and subscribe topics only if the topics are granted to the peer. An event message e is notified to a peer pi if the publication of e and subscription of pi include some common topic. If a peer pi publishes an event message e2 after receiving an event message e1, the event message e2 may bring the event of e1, which the peer pi is not allowed to publish. Here, Information in the peer pi illegally Flow to another peer. We define the legal Flow relation among the peers. Then, we newly propose a subscription-based synchronization (SBS) protocol to prevent illegal Information Flow. Here, a notification is banned if the notification may cause illegal Information Flow. We evaluate the SBS protocol in terms of number of notifications banned.
-
role based Information Flow Control models
Advanced Information Networking and Applications, 2014Co-Authors: Shigenari Nakamura, Dilewaer Doulikun, Ailixier Aikebaier, Tomoya Enokido, Makoto TakizawaAbstract:In Information systems, data in an object may illegally Flow into another object if a subject manipulates the objects. In this paper, we discuss Information Flow Control models to prevent illegal Information to occur in the role-based access Control (RBAC) model. First, we define a legal Information Flow relation ri-> rj among roles ri and rj. It means, if a subject granted the role ri manipulates objects before another subject granted the role rj, no illegal Information Flow occur. We discuss safe systems where no illegal Information Flow occur even if operations from different subjects are performed in any order. Then, we discuss a role-based synchronization (RBS) protocol and an object-based synchronization (OBS) protocol to prevent illegal Information Flow in unsafe systems. Here, a transaction is aborted if the transaction reads an object and illegal Information Flow might occur. In the RBS protocol, the illegal Information Flow condition is specified in terms of roles while objects in the OBS protocol. We evaluate the RBS and OBS protocols in terms of number of transactions aborted.
-
purpose based Information Flow Control for cyber engineering
IEEE Transactions on Industrial Electronics, 2011Co-Authors: Tomoya Enokido, Makoto TakizawaAbstract:Cyber engineering is getting more significant in not only manufacturing but also business applications. Information management technologies play a key role in cyber engineering. In order to realize the cyber engineering, objects in Information systems are required to be not only secure but also consistent in the presence of security threats and multiple conflicting transactions. There are so far many discussions on each of the security management and concurrence Control. However, there is no discussion on synchronization mechanisms to realize both of them. In this paper, we discuss a novel synchronization protocol to make an Information system not only secure but also consistent. In the role-based access Control model, authorized access requests are specified in roles which are collections of access rights. A transaction issued by a subject is assigned with a subfamily of the roles granted to the subjects, which are named purpose. We first define legal Information Flow relations among purposes. Based on the legal Information Flow relations, we discuss a purpose-marking (PM) protocol to prevent illegal Information Flow to occur by performing conflicting transactions in a serializable way. We evaluate the PM protocol in terms of the number of transactions to be aborted.