Analyzing Information flow Properties in Assembly Code by Abstract Interpretation

Computer Journal

Volumn 47, Issue 1, 2004, Pages 25-45

  Barbuti, Roberto ^a   Bernardeschi, Cinzia ^a   De Francesco, Nicoletta ^a  

^a UNIVERSITY OF PISA   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

ABSTRACTING; CODES (SYMBOLS); COMPUTER PROGRAM LISTINGS; DATA REDUCTION; HIGH LEVEL LANGUAGES; SECURITY OF DATA; SEMANTICS; SET THEORY; THEOREM PROVING;

INFORMATION FLOW; INFORMATION LEAKAGE; MACHINE CODE;

INFORMATION SCIENCE;

EID: 0346685887     PISSN: 00104620     EISSN: None     Source Type: Journal    
DOI: 10.1093/comjnl/47.1.25     Document Type: Article

References (47)

1. Bell, D. E. and La Padula, L. J. (1973) Secure Computer Systems: Mathematical Foundations and Model. Technical Report M74-244, MITRE Corporation, Bedford, Massachusetts.
2. Denning, D. E. (1976) A lattice model of secure information flow. Commun. ACM, 19(5), 236-243.
3. Denning, D. E. and Denning, P. J. (1977) Certification of programs for secure information flow. Commun. ACM, 20(7), 504-513.
4. Andrews, G. R. and Reitman, R. P. (1980) An axiomatic approach to information flow in programs. ACM Trans. Programm. Lang. Syst., 2(1), 56-76.
5. Lampson, B. W. (1973) A note on the confinement problem. Commun. ACM, 16(10), 613-615.
6. Volpano, D. and Smith, G. (1997) Eliminating covert flows with minimum typing. In Proc. 10th IEEE Computer Security Security Foundation Workshop, pp. 156-168.
7. Banatre, J., Bryce, C. and Métayer, D. L. (1994) Compile-time detection of information flow in sequential programs. In Proc. European Symp. on Research in Computer Security, LNCS 875, pp. 55-73. Springer-Verlag.
8. Smith, G. and Volpano, D. (1998) Secure information flow in a multi-threaded imperative language. In Proc. 25th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, pp. 1-10. San Diego, California.
9. Sabelfeld, A. and Sands, D. (1999) A PER model of secure information flow in sequential programs. In Proc. 8th European Symp. on Programming, ESOP'99, LNCS 1576, pp. 40-58. Springer-Verlag.
10. Heintze, N. and Riecke, J. G. (1998) The Slam Calculus: programming with secrecy and integrity. In Proc. 25th ACM Principles of Programming Languages Conf., pp. 365-377. San Diego, USA.
11. Myers, A. C. and Liskov, B. (1998) Complete, safe information flow with decentralized labels. In Proc. 1998 IEEE Symp. on Security and Privacy, pp. 186-197.
12. Pottier, F. and Conchon, S. (2000) Information flow inference for free. In Proc. ACM ICFP'00, pp. 46-57.
13. Lindholm, T. and Yellin, F. (1996) The Java Virtual Machine Specification. Addison-Wesley Publishing Company, Reading, Massachusetts.
14. Zdancewic, S. and Myers, A. C. (2002) Secure information flow via linear continuations, Higher Order and Symbolic Computation, 15(2/3), 209-224.
15. Cousot, P. and Cousot, R. (1977) Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proc. 4th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, pp. 238-252. Los Angeles, California.
16. Cousot, P. and Cousot, R. (1992) Abstract interpretation frameworks. J. Logic Comput., 2, 511-547.
17. Cousot, P. and Cousot, R. (1992) Inductive definitions, semantics and abstract interpretations. In Proc. 19th ACM Symp. on Principles of Programming Languages, POPL'92, pp. 83-94.
18. Schmidt, D. A. (1996) Abstract interpretation of small-step semantics. In M. Dam and F. Orava, eds, Proc. 5th LOMAPS Workshop on Analysis and Verification of Multiple-Agent Languages, pp. 76-77. Springer.
19. Clarke, E. M., Emerson, E. A. and Sistla, A. P. (1986) Automatic verification of finite-state concurrent systems using temporal logic specifications. ACM Trans. on Programm. Lang. Syst., 8(2), 244-263.
20. Schmidt, D. A. (1998) Data-flow analysis is model checking of abstract interpretations. In Proc. 25th ACM Symp. Principles of Programming Languages, pp. 38-48. San Diego.
21. Plotkin, G. D. (1981) A Structural Approach to Operational Semantics. Technical Report DAIMI FN-19, Computer Science Department, Aarhus University, Denmark.
22. Ball, T. (1993) What's in a region? Or computing control dependence regions in near-linear time for reducible control flow. ACM Lett. on Programm. Lang. Syst., 2(1-4), 1-16.
23. Volpano, D., Smith, G. and Irvine, C. (1996) A sound type system for secure flow analysis. J. Comp. Sec., 4(3), 167-187.
24. Cleaveland, R. and Sims, S. (1996) The NCSU concurrency workbench. In Proc. Workshop on Computer Aided Verification (CAV'96), LNCS 1102, pp. 394-397. Springer-Verlag.
25. McMillan, K. L. (1999) The SMV Language. Cadence Berkeley Labs, Cadence Design Systems, Berkeley.
26. Stirling, C. (1989) An introduction to modal and temporal logics for CCS. In Proc. Concurrency: Theory, Language, and Architecture, LNCS 391, pp. 2-20. Springer-Verlag.
27. Goguen, J. and Meseguer, J. (1982) Security policies and security models. In Proc. 1982 EEE Symp. on Security and Privacy, pp. 11-20.
28. Abadi, M., Banerjee, A., Heintze, N. and Riecke, J. G. (1999) A core calculus of dependency. In Proc. 26th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages Conf., pp. 147-160. San Antonio, Texas, USA.
29. Myers, A. C. (1999) Jflow: practical mostly-static information flow control. In Proc. 26th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages Conf., pp. 228-241. San Antonio, Texas, USA.
30. Zdancewic, S. and Myers, A. C. (2001) Secure information flow and CPS. In Proc. 10th European Symp. on Programming, ESOP 2001, LNCS 2028, pp. 46-61. Springer.
31. Banerjee, A. and Naumann, D. A. (2002) Secure information flow and pointer confinement in a Java-like language. In Proc. 15th IEEE Computer Security Foundations Workshop, CSFW02, pp. 253-270.
32. Pettier, F. and Simonet, V. (2002) Information flow inference for ML. In Proc. 29th ACM Symp. on Principles of Programming Languages, pp. 319-330.
33. Mizuno, M. and Schmidt, D. A. (1992) A security flow control algorithm and its denotational semantics correctness proof. Formal Aspects of Computing, 4, 727-754.
34. Leino, K. R. M. and Joshi, R. (1998) A semantic approach to secure information flow. In Proc. 4th International Conf., Mathematics of Program Construction, Sweden, LNCS 1422, pp. 254-271. Springer-Verlag.
35. Barbuti, R., Bernardeschi, C. and De Francesco, N. (2002) Abstract interpretation of operational semantics for secure information flow. Inform. Process. Lett., 83(2), 101-108.
36. Bieber, P., Cazin, J., Girard, P., Lanet, J.-L., Wiels, V. and Zanon, G. (2000) Checking secure interactions of smart card applets. In Proc. ESORICS 2000, pp. 1-16.
37. Morrisett, J. G., Crary, K., Glow, N. and Walker, D. (2002) Stack-based typed assembly language. J. Fund. Program., 12(1), 3-88.
38. O'Callahan, R. (1999) A simple, comprehensive type system for Java bytecode subroutines. In Proc. 26th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, pp. 70-78. San Antonio, Texas, USA.
39. Stata, R. and Abadi, M. (1999) A type system for Java bytecode subroutine. ACM Trans. on Programming Languages and Systems, 21(1), 90-137.
40. Necula, G. C. and Lee, P. (1996) Safe kernel extensions without, run-time checking. In Proc. Second Usenix Symp. on Operating Systems Design and Implementation (OSDI), pp. 229-243.
41. Necula, G. C. (1997) Proof-carrying code. In Proc. 24th Annual Symp. on Principles of Programming Languages, pp. 106-119.
42. Appel, A. W. and Felty, A. P. (2000) A semantic model of types and machine instructions for proof-carrying code. In Proc. ACM SIGPLAN Conf. on Programming Language Design and Implementation, pp. 243-253. Vancouver, Canada.
43. Xu, Z., Miller, B. P. and Reps, T. (2000) Safety checking of machine code. In Proc. ACM SIGPLAN Conf. on Programming Language Design and Implementation, pp. 70-82. Vancouver, Canada.
44. Dhem, J. F., Koeune, F., Leroux, P. A., Mesuré, P., Quisquater, J. J. and Willems J. J. (2000) A practical implementation of the timing attack. In Proc. CARDIS 1998, LNCS 1820, pp. 167-182. Springer.
45. Handschuh, H. and Keys, H. M. (1999) A timing attack on RC5. In Proc. Selected Areas in Cryptography, SAC'98, LNCS 1556, pp. 306-318. Springer.
46. Barbuti, R., Bernardeschi, C. and De Francesco, N. (2002) Checking security of Java bytecode by abstract interpretation. In Proc. 17th ACM Symp. on Applied Computing: Special Track on Computer Security Proceedings, pp. 229-237. Madrid.
47. Bernardeschi, C. and De Francesco, N. (2002) Combining abstract interpretation and model checking for analysing security properties of Java bytecode. In Proc. 3rd Int. Workshop on Verification, Model Checking and Abstract Interpretation, LNCS 2294, pp. 1-15. Springer-Verlag.