Automatic discovery and quantification of information leaks

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2009, Pages 141-153

  Backes, Michael ^a   Köpf, Boris ^a   Rybalchenko, Andrey ^a  

^a SAARLAND UNIVERSITY   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATIC DISCOVERY; AUTOMATIC METHOD; EQUIVALENCE RELATIONS; EXPERIMENTAL EVALUATION; FORMAL MODEL; INFORMATION FLOW ANALYSIS; INFORMATION-THEORETIC ANALYSIS; MEASUREMENT PROCEDURES; PROGRAM VARIABLES; PROGRAM VERIFICATION; QUALITATIVE INFORMATION; QUANTITATIVE INFORMATION; QUANTITATIVE INTERPRETATION; SENSITIVE INFORMATIONS;

AUTOMATA THEORY; EQUIVALENCE CLASSES; FORMAL LOGIC; INFORMATION THEORY; NETWORK SECURITY; PULSATILE FLOW; SET THEORY;

PROGRAM INTERPRETERS;

EID: 70449625216     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2009.18     Document Type: Conference Paper

References (41)

1. T. Amtoft, S. Bandhakavi, and A. Banerjee. A logic for information flow in object-oriented programs. In Proc. Symposium on Principles of Programming Languages (POPL '06), pages 91-102. ACM Press, 2006.
2. R. B. Ash. Information Theory. Dover Publications Inc., 1990.
3. T. Ball, R. Majumdar, T. Millstein, and S. Rajamani. Automatic predicate abstraction of C programs. In Proc. ACM Conference On Programming Language Design and Implementation (PLDI '01), volume 36 of ACM SIGPLAN Notices, 2001.
4. A. Banerjee, D. A. Naumann, and S. Rosenberg. Expressive declassification policies and modular static enforcement. In Proc. IEEE Symposium on Security and Privacy (S&P '08), pages 339-353. IEEE Computer Society, 2008.
5. G. Barthe, P. D'Argenio, and T. Rezk. Secure Information Flow by Self-Composition. In Proc. IEEE Computer Security Foundations Workshop (CSFW '04), pages 100-114. IEEE Computer Society, 2004.
6. A. Barvinok. A Polynomial Time Algorithm for Counting Integral Points in Polyhedra when the Dimension is Fixed. Mathematics of Operations Research, 19:189-202, 1994.
7. C. Cachin. Entropy Measures and Unconditional Security in Cryptography. PhD thesis, ETH Zürich, 1997.
8. C. Calcagno, D. Distefano, P. W. O'Hearn, and H. Yang. Compositional shape analysis by means of bi-abduction. In Proc. Symposium on Principles of Programming Languages (POPL '09), pages 289-300. ACM Press, 2009.
9. D. Clark, S. Hunt, and P. Malacaria. Quantitative Information Flow, Relations and Polymorphic Types. J. Log. Comput., 18(2):181-199, 2005.
10. D. Clark, S. Hunt, and P. Malacaria. A static analysis for quantifying information flow in a simple imperative language. Journal of Computer Security, 15(3):321-371, 2007.
11. E. M. Clarke, D. Kroening, N. Sharygina, and K. Yorav. Satabs: SAT-based predicate abstraction for ANSI-C. In Proc. Intl. Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS' 05), volume 3440 of LNCS, pages 570-574. Springer, 2005.
12. M. R. Clarkson, A. C. Myers, and F. B. Schneider. Belief in Information Flow. In Proc. IEEE Computer Security Foundations Workshop (CSFW '05), pages 31-45. IEEE Computer Society, 2005.
13. E. Cohen. Information Transmission in Sequential Programs. In Foundations of Secure Computation, pages 297-335. Academic Press, 1978.
14. B. Cook, A. Podelski, and A. Rybalchenko. Termination proofs for systems code. In Proc. ACM Conference on Programming Language Design and Implementation (PLDI '06), pages 415-426. ACM Press, 2006.
15. P. Cousot and R. Cousot. Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints. In Proc. Symposium on Principles of Programming Languages (POPL '77), pages 238-252, 1977.
16. A. Darvas, R. Hähnle, and D. Sands. A Theorem Proving Approach to Analysis of Secure Information Flow. In Proc. International Conference on Security in Pervasive Computing, LNCS 3450, pages 193 - 209. Springer, 2005.
17. D. E. Denning. Cryptography and Data Security. Addison-Wesley, 1982.
18. R. Giacobazzi and I. Mastroeni. Abstract Non-Interference: Parameterizing Non-Interference by Abstract Interpretation. In Proc. ACM Symposium on Principles of Programming Languages (POPL '04), pages 186-197. ACM, 2004.
19. S. Graf and H. Saïdi. Construction of Abstract State Graphs with PVS. In Proc. Intl. Conference on Computer Aided Verification (CAV '97), volume 1254 of LNCS, pages 72-83. Springer, 1997.
20. J. W. Gray. Toward a Mathematical Foundation for Information Flow Security. Journal of Computer Security, 1(3-4):255-294, 1992.
21. T. A. Henzinger, R. Jhala, R. Majumdar, and K. L. McMillan. Abstractions from proofs. In Proc. ACM Symposium on Principles of Programming Languages (POPL '04), pages 232-244. ACM Press, 2004.
22. R. Jhala and K. L. McMillan. Array abstractions from proofs. In Proc. Intl. Conference on Computer Aided Verification (CAV '07), volume 4590 of LNCS, pages 193-206. Springer, 2007.
23. B. Köpf and D. Basin. Timing-Sensitive Information Flow Analysis for Synchronous Systems. In Proc. European Symposium on Research in Computer Security (ESORICS '06), LNCS 4189, pages 243-262. Springer, 2006.
24. B. Köpf and D. Basin. An Information-Theoretic Model for Adaptive Side-Channel Attacks. In Proc. ACM Conference on Computer and Communications Security (CCS '07), pages 286-296. ACM, 2007.
25. J. A. D. Loera, D. Haws, R. Hemmecke, P. Huggins, J. Tauzer, and R. Yoshida. LattE. http://www.math.ucdavis.edu/latte/. [Online; accessed 08-Nov-2008].
26. G. Lowe. Quantifying Information Flow. In Proc. IEEE Computer Security Foundations Workshop (CSFW '02), pages 18-31. IEEE Computer Society, 2002.
27. P. Malacaria. Assessing security threats of looping constructs. In Proc. Symposium on Principles of Programming Languages (POPL '07), pages 225-235. ACM Press, 2007.
28. J. L. Massey. Guessing and Entropy. In Proc. IEEE International Symposium on Information Theory (ISIT '94), page 204. IEEE Computer Society, 1994.
29. S. McCamant and M. D. Ernst. Quantitative information flow as network flow capacity. In Proc. Conf. on Programming Language Design and Implementation (PLDI '08), pages 193-205, 2008.
30. J. K. Millen. Covert Channel Capacity. In Proc. IEEE Symposium on Security and Privacy (S&P '87), pages 60-66. IEEE Computer Society, 1987.
31. A. Podelski and A. Rybalchenko. ARMC: the logical choice for software model checking with abstraction refinement. In Proc. Intl. Symposium on Practical Aspects of Declarative Languages (PADL '07). Springer, 2007.
32. E. Rosser, W. Kelly, W. Pugh, D. Wonnacott, T. Shpeisman, and V. Maslov. The Omega Project. http://www.cs.umd.edu/projects/omega/. [Online; accessed 05-Nov-2008].
33. A. Sabelfeld and A. C. Myers. Language-based Information- Flow Security. IEEE J. Selected Areas in Communication, 21(1):5-19, 2003.
34. A. Sabelfeld and A. C. Myers. A model for delimited information release. In Proc. Intl. Symposium on Software Security (ISSS '03), LNCS 3233, pages 174-191. Springer, 2004.
35. A. Sabelfeld and D. Sands. Dimensions and Principles of Declassification. In Proc. IEEE Workshop on Computer Security Foundations (CSFW '05), pages 255-269. IEEE Computer Society, 2005.
36. C. E. Shannon. A Mathematical Theory of Communication. Bell System Technical Journal, 27:379-423 and 623-656, July and October 1948.
37. G. Smith. On the foundations of quantitative information flow. In Proc. Intl. Conference of Foundations of Software Science and Computation Structures (FoSSaCS '09), LNCS 5504, pages 288-302. Springer, 2009.
38. T. Terauchi and A. Aiken. Secure information flow as a safety problem. In Proc. Intl. Symposium on Static Analysis (SAS '05), LNCS 3672, pages 352-367. Springer, 2005.
39. H. Unno, N. Kobayashi, and A. Yonezawa. Combining Type- Based Analysis and Model Checking for Finding Counterexamples Against Non-interference. In Proc. Workshop on Programming Languages and Analysis for Security (PLAS '06), pages 17-26. ACM Press, 2006.
40. J. T. Wittbold and D. M. Johnson. Information Flow in Nondeterministic Systems. In Proc. IEEE Symposium on Security and Privacy (S&P '90), pages 144-161. IEEE Computer Society, 1990.
41. S. Zdancewic and A. C. Myers. Robust declassification. In Proc. IEEE Computer Security Foundations Workshop (CSFW '01), pages 15-23. IEEE Computer Society, 2001.