Abstract
Before starting the security analysis of an existing system, the most likely outcome is often already clear, namely that the system is not entirely secure. Modifying a program such that it passes the analysis is a difficult problem and usually left entirely to the programmer. In this article, we show that and how unification can be used to compute such program transformations. This opens a new perspective on the problem of correcting insecure programs. We demonstrate that integrating our approach into an existing transforming type system can also improve the precision of the analysis and the quality of the resulting programs.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
[Aga00] Agat, J.: Transforming out Timing Leaks. In: Proceedings of the 27th ACM Symposium on Principles of Programming Languages, pp. 40–53 (2000)
[BC02]Boudol, G., Castellani, I.: Noninterference for Concurrent Programs and Thread Systems. Theoretical Computer Science 281, 109–130 (2002)
[BN02] Banerjee, A., Naumann, D.A.: Secure Information Flow and Pointer Confinement in a Java-like Language. In: Proceedings of the 15th IEEE Computer Security Foundations Workshop, Cape Breton, Nova Scotia,Canada pp. 253-270 (2002)
[BS01]Baader, F., Snyder, W.: Unification theory. In: Robinson, A., Voronkov, A. (eds.) Handbook of Automated Reasoning, ch.8,vol.1, pp. 445–532. Elsevier Science, Amsterdam (2001)
[HR98] Heintze, N., Riecke, J.G.: The SLam Calculus: Programming with Secrecy and Integrity. In: Proceedings of the 25th ACM Symposium on Principles of Programming Languages, pp. 365–377 (1998)
[HS87] Herold, A., Siekmann, J.: Unification in Abelian Semigroups. Journal of Automated Reasoning 3, 247–283 (1987)
[HY02] Honda, K., Yoshida, N.: A uniform type structure for secure information flow. In: Proceedings of the 29th ACM Symposium on Principles of Programming Languages, pp. 81–92. ACM Press, New York (2002)
[KM05] Köpf, B., Mantel, H.: Eliminating Implicit Information Leaks by Transformational Typing and Unification. Technical Report 498, ETH Zürich (2005)
[MS04] Mantel, H., Sands, D.: Controlled Declassification based on Intransitive Noninterference. In: APLAS 2004. LNCS, vol. 3303, pp. 129–145. Springer, Heidelberg (2004)
[Mye99] Myers, A.: JFlow: Practical mostly-static information flow control. In: Symposium on Principles of Programming Languages, pp. 228–241 (1999)
[Sab01] Sabelfeld, A.: The impact of synchronisation on secure information flow in concurrent programs. In: Bjørner, D., Broy, M., Zamulin, A.V. (eds.) PSI 2001. LNCS, vol. 2244, pp. 225–239. Springer, Heidelberg (2001)
Sabelfeld, A., Mantel, H.: Static Confidentiality Enforcement for Distributed Programs. In: Hermenegildo, M.V., Puebla, G. (eds.) SAS 2002. LNCS, vol. 2477, pp. 376–394. Springer, Heidelberg (2002)
[SM03]Sabelfeld, A., Myers, A.C.: Language-based Information-Flow Security. IEEE Journal on Selected Areas in Communication 21(1), 5–19 (2003)
[SS99] Sabelfeld, A., Sands, D.: A Per Model of Secure Information Flow in Sequential Programs. In: Swierstra, S.D. (ed.) ESOP 1999. LNCS, vol. 1576, pp. 50–59. Springer, Heidelberg (1999)
[SS00]Sabelfeld, A., Sands, D.: Probabilistic Noninterference for Multi-threaded Programs. In: Proceedings of the 13th IEEE Computer Security Foundations Workshop, Cambridge, UK, pp. 200–215 (2000)
[SV98] Smith, G., Volpano, D.: Secure Information Flow in a Multi-Threaded Imperative Language. In: 25th ACM Symposium on Principles of Programming Languages, San Diego, California, pp. 355–364 (1998)
[VS97]Volpano, D., Smith, G.: A Type-Based Approach to Program Security. In: Bidoit, M., Dauchet, M. (eds.) CAAP 1997, FASE 1997, and TAPSOFT 1997. LNCS, vol. 1214, pp. 607–621. Springer, Heidelberg (1997)
[VS98]Volpano, D., Smith, G.: Probabilistic Noninterference in a Concurrent Language. In: Proceedings of the 11th IEEE Computer Security Foundations Workshop, Rockport, Massachusetts, pp. 34–43 (1998)
[ZM03]Zdancewic, S., Myers, A.: Observational determinism for concurrent program security. In: Proceedings of the 16th IEEE Computer Security Foundations Workshop, pp. 29–47. IEEE Computer Society, Los Alamitos (2003)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Köpf, B., Mantel, H. (2006). Eliminating Implicit Information Leaks by Transformational Typing and Unification. In: Dimitrakos, T., Martinelli, F., Ryan, P.Y.A., Schneider, S. (eds) Formal Aspects in Security and Trust. FAST 2005. Lecture Notes in Computer Science, vol 3866. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11679219_5
Download citation
DOI: https://doi.org/10.1007/11679219_5
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-32628-1
Online ISBN: 978-3-540-32629-8
eBook Packages: Computer ScienceComputer Science (R0)