From languages to systems: Understanding practical application development in security-typed languages

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2006, Pages 153-164

  Hicks, Boniface ^a   Ahmadizadeh, Kiyan ^a   McDaniel, Patrick ^a  

^a PENNSYLVANIA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

POLICY TOOLS; REAL-WORLD POLICIES; SECURITY-TYPED LANGUAGES;

COMPUTER AIDED SOFTWARE ENGINEERING; ELECTRONIC MAIL; SECURITY OF DATA;

COMPUTER PROGRAMMING LANGUAGES;

EID: 39049162501     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2006.30     Document Type: Conference Paper

References (29)

1. A. Askarov and A. Sabelfeld. Secure implementation of cryptographic protocols: A case study of mutual distrust. In Proceedings of the 10th European Symposium on Research in Computer Security (ESORICS '05), LNCS, Milan, Italy, September 2005. Springer-Verlag.
2. L. Bauer, J. Ligatti, and D. Walker. Composing security policies with polymer. In PLDI '05: Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation, pages 305-314, New York, NY, USA, 2005. ACM Press.
3. D. E. Bell and L. J. LaPadula. Secure computer systems: Mathematical foundations. Technical Report MTR-2547, Vol. 1, MITRE Corp., Bedford, MA, 1973.
4. J. Callas, L. Donnerhacke, H. Finney, and R. Thayer. Openpgp message format. IETF RFC 2440, November 1998.
5. S. Chong and A. C. Myers. Decentralized robustness. In Proceedings of the 19th IEEE Computer Security Foundations Workshop (CSFW), Venice, Italy, July 2006. to appear.
6. P. T. Devanbu and S. Stubblebine. Software engineering for security: a roadmap. In ICSE '00: Proceedings of the Conference on The Future of Software Engineering, pages 227-239, New York, NY, USA, 2000. ACM Press.
7. Federal Trade Commission. Eli Lilly settles FTC charges concerning security breach. FTC Press Release, January 18 2002. http://www.ftc.gov/opa/ 2002/01/elililly.htm.
8. Federal Trade Commission. Cardsystems Solutions settles FTC charges. FTC Press Release, February 23 2006. http://www.ftc.gov/opa/2006/02/cardsystems_r. htm.
9. D. F Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn, and R. Chandramouli. Proposed nist standard for role-based access control. ACM Trans. Inf. Syst. Secur. (TISSEC), 4(3):224-274, 2001.
10. S. L. Garfinkel, E. Nordlander, R. C. Miller, D. Margrave, and J. I. Schiller. How to make secure email easier to use. In Proceedings of the Conference on Human Factors in Computing Systems (CHI), Portland, Oregon, April 2005. SIGCHI.
11. J. A. Goguen and J. Meseguer. Security policies and security models. In IEEE Symposium on Security and Privacy, pages 11-20, April 1982.
12. B. Hicks, D. King, P. McDaniel, and M. Hicks. Trusted declassification: High-level policy for a security-typed language. In Proceedings of the 1st ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS '06), Ottawa, Canada, June 10 2006. ACM Press.
13. B. Hicks, S. Rueda, T. Jaeger, and P. McDaniel. Breaking Down the Walls of Mutual Distrust: Security-typed Email Using Labeled IPsec. Technical Report NAS-TR-0049-2006, Network and Security Research Center, Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA, Sept. 2006.
14. H. Mantel and A. Sabelfeld. A unifying approach to the security of distributed and multi-threaded programs. J. Computer Security, 11(4):615-676, 2003.
15. A. C. Myers. JFlow: Practical mostly-static information flow control. In POPL, pages 228-241, January 1999.
16. A. C. Myers. Mostly-static decentralized information flow control. Technical Report MIT/LCS/TR-783, Massachusetts Institute of Technology, University of Cambridge, January 1999. Ph.D. thesis.
17. A. C. Myers and B. Liskov. Protecting privacy using the decentralized label model. ACM Transactions on Software Engineering and Methodology, 9(4):410-442, 2000.
18. A. C. Myers, N. Nystrom, L. Zheng, and S. Zdancewic. Jif: Java + information flow. Software release. Located at http://www.cs.cornell.edu/jif, July 2001.
19. F Pottier and V. Simonet. Information flow inference for ML. In POPL, pages 319-330, January 2002.
20. B. Ross and R. Esposito. Espionage case breaches the white house. ABC news report, Oct. 5 2005. http://abcnews.go.com/WNT/story?id=1187030.
21. A. Sabelfeld and A. C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1):5-19, January 2003.
22. A. Sabelfeld and D. Sands. Dimensions and principles of declassification. In Proceedings of the IEEE Computer Security Foundations Workshop, Aix-en-Provence, France, June 2005.
23. U. Shankar, T. Jaeger, and R. Sailer. Toward automated information-flow integrity verification for security-critical applications. In NDSS. The Internet Society, 2006.
24. V. Simonet. FlowCaml in a nutshell. In G. Hutton, editor, Proceedings of the first APPSEM-II workshop, pages 152-165, March 2003.
25. N. Swamy, M. Hicks, S. Tse, and S. Zdancewic. Managing policy updates in security-typed languages. In CSFW '06: Proceedings of the 19th IEEE Computer Security Foundations Workshop, 2006.
26. S. Tse and G. Washburn. Cryptographic programming in jif. Project report for CIS-670, Spring 2003, Feb. 11 2004. http://www.cis.upenn.edu/~stse/bank/ main.pdf.
27. D. Volpano and G. Smith. Probabilistic noninterference in a concurrent language. JCS, 7(2-3):231-253, November 1999.
28. D. Volpano, G. Smith, and C. Irvine. A sound type system for secure flow analysis. JCS, 4(3):167-187, 1996.
29. S. Zdancewic. A Type System for Robust Declassification. In Proceedings of the Nineteenth Conference on the Mathematical Foundations of Programming Semantics. Electronic Notes in Theoretical Computer Science, March 2003.