Using access control for secure information flow in a Java-like language

Proceedings of the Computer Security Foundations Workshop

Volumn 2003-January, Issue , 2003, Pages 155-169

  Banerjee, A ^a   Naumann, D A ^b  

^a Sunflower Networking Group   (United States)

^b Stevens Institute of Technology   (United States)

Author keywords

Access control; Authorization; Computer science; Computer security; Engineering profession; Information analysis; Information security; Inspection; Java; Permission

Indexed keywords

COMPUTATIONAL LINGUISTICS; COMPUTER SCIENCE; INFORMATION ANALYSIS; INSPECTION; JAVA PROGRAMMING LANGUAGE; PROFESSIONAL ASPECTS; SECURITY OF DATA; SECURITY SYSTEMS; STATIC ANALYSIS;

ACCESS CONTROL MECHANISM; AUTHORIZATION; DYNAMIC ACCESS CONTROL; ENGINEERING PROFESSION; JAVA; NONINTERFERENCE PROPERTIES; PERMISSION; SECURE INFORMATION FLOW;

ACCESS CONTROL;

EID: 33947655397     PISSN: 10636900     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSFW.2003.1212711     Document Type: Conference Paper

References (25)

1. M. Abadi, A. Banerjee, N. Heintze, and J. G. Riecke. A core calculus of dependency. In ACM Symposium on Principles of Programming Languages (POPL), pages 147-160, 1999.
2. A. Banerjee and D. A. Naumann. Ownership confinement ensures representation independence for object-oriented programs. Revised and extended from [3]; submitted., 2002.
3. A. Banerjee and D. A. Naumann. Representation independence, confinement and access control. In ACM Symposium on Principles of Programming Languages (POPL), pages 166-177. ACM Press, 2002.
4. A. Banerjee and D. A. Naumann. Secure information flow and pointer confinement in a Java-like language. In IEEE Computer Security Foundations Workshop (CSFW), pages 253-270. IEEE Computer Society Press, 2002.
5. D. Bell and L. LaPadula. Secure computer systems: Mathematical foundations. Technical Report MTR-2547, MITRE Corp., 1973.
6. D. Denning. A lattice model of secure information flow. Communications of the ACM, 19(5):236-242, 1976.
7. D. E. Denning. Cryptography and Data Security. Addison-Wesley, 1982.
8. C. Fournet and A. D. Gordon. Stack inspection: Theory and variants. In ACM Symposium on Principles of Programming Languages (POPL), pages 307-318. ACM Press, 2002.
9. J. Goguen and J. Meseguer. Security policies and security models. In Proceedings of the 1982 IEEE Symposium on Security and Privacy, pages 11-20, 1982.
10. L. Gong. Inside Java 2 Platform Security. Addison-Wesley, 1999.
11. J. Gough. Compiling for the .NET Common Language Runtime. Prentice Hall, 2001.
12. N. Heintze and J. G. Riecke. The SLam calculus: programming with secrecy and integrity. In ACM Symposium on Principles of Programming Languages (POPL), pages 365-377, 1998.
13. M. Hennessy and J. Riely. Information flow vs. resource access in the asynchronous pi-calculus. ACM Trans. Prog. Lang. Syst., 24(5):566-591, 2002.
14. H. Mantel and A. Sabelfeld. A generic approach to the security of multi-threaded programs. In Proceedings of the 14th IEEE Computer Security Foundations Workshop, pages 126-142, Cape Breton, Nova Scotia, Canada, June 2001. IEEE Computer Society Press.
15. A. Myers and B. Liskov. Complete, safe information flow with decentralized labels. In IEEE Symposium on Security and Privacy, pages 186-197, 1998.
16. A. C. Myers. JFlow: Practical mostly-static information flow control. In ACM Symposium on Principles of Programming Languages (POPL), pages 228-241, 1999.
17. F. Pottier and S. Conchon. Information flow inference for free. In Proceedings of the fifth ACM International Conference on Functional Programming, pages 46-57, 2000.
18. F. Pottier and V. Simonet. Information flow inference for ML. In ACM Symposium on Principles of Programming Languages (POPL), pages 319-330, 2002.
19. F. Pottier, C. Skalka, and S. Smith. A systematic approach to static access control. In D. Sands, editor, Proceedings of the 10th European Symposium on Programming (ESOP'01), volume 2028 of Lecture Notes in Computer Science, pages 30-45. Springer Verlag, Apr. 2001.
20. J. Rushby. Noninterference, transitivity, and channel-control security policies. Technical report, SRI, Dec. 1992.
21. A. Sabelfeld and A. C. Myers. Language-based information-flow security. IEEE J. Selected Areas in Communications, 21(1):5-19, Jan. 2003.
22. C. Skalka and S. Smith. Static enforcement of security with types. In Proceedings of the fifth ACM International Conference on Functional Programming, pages 34-45, 2000.
23. A. Stoughton. Access flows: A protection model which integrates access control and information flow. In IEEE Symposium on Security and Privacy, pages 9-18, 1981.
24. D. Volpano and G. Smith. A type-based approach to program security. In Proceedings of TAPSOFT'97, number 1214 in Lecture Notes in Computer Science, pages 607-621. Springer-Verlag, 1997.
25. D. Volpano, G. Smith, and C. Irvine. A sound type system for secure flow analysis. Journal of Computer Security, 4(3):167-187, 1996.