Encoding information flow in AURA

PLAS'09 - Proceedings of the ACM SIGPLAN 4th Workshop on Programming Languages and Analysis for Security

Volumn , Issue , 2009, Pages 17-29

  Jia, Limin ^a   Zdancewic, Steve ^a  

^a UNIVERSITY OF PENNSYLVANIA   (United States)

Author keywords

Access control; Authorization logic; Declassification; Information flow control; Security type system

Indexed keywords

AUTHORIZATION LOGIC; CONTROL POLICY; ENCODING INFORMATIONS; INFORMATION FLOW CONTROL; INFORMATION FLOWS; PROGRAMMING LANGUAGE; REFERENCE MONITORS; SECURITY LABEL; SECURITY TYPES; SECURITY-SENSITIVE RESOURCES;

COMPUTER CONTROL SYSTEMS; COMPUTER SOFTWARE; ENCODING (SYMBOLS); FLOW CONTROL; LINGUISTICS; NETWORK SECURITY; QUERY LANGUAGES; SECURITY SYSTEMS; STREAM FLOW;

ACCESS CONTROL;

EID: 70450285315     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1554339.1554344     Document Type: Conference Paper

References (32)

1. M. Abadi. Logic in access control. In Proceedings of the 18th Symposium on Logic in Computer Science (LICS), June 2003.
2. M. Abadi. Access control in a core calculus of dependency. In Proceedings of the 11th ACM SIGPLAN International Conference on Functional Programming, ICFP, 2006.
3. M. Abadi. Access control in a core calculus of dependency. Computation, Meaning, and Logic: Articles dedicated to Gordon Plotkin ENTCS, 172:5-31, April 2007.
4. M. Abadi, A. Banerjee, N. Heintze, and J. Riecke. A core calculus of dependency. In Proc. 26th ACM Symp. on Principles of Programming Languages (POPL), Jan. 1999.
5. M. Abadi, M. Burrows, B. W. Lampson, and G. D. Plotkin. A calculus for access control in distributed systems. Transactions on Programming Languages and Systems, 15(4):706-734, Sept. 1993.
6. A. Askarov and A. Sabelfeld. Gradual release: Unifying declassification, encryption and key release policies. In Proceedings of the 2007 IEEE Symposium on Security and Privacy, 2007.
7. A. Askarov and A. Sabelfeld. Localized delimited release: combining the what and where dimensions of information release. In PLAS '07: Proceedings of the 2007 workshop on Programming languages and analysis for security, 2007.
8. A. Banerjee, D. A. Naumann, and S. Rosenberg. Expressive declassification policies and modular static enforcement. Security and Privacy, IEEE Symposium on, 2008.
9. H. P. Barendregt. Lambda calculi with types. In S. Abramsky, D. M. Gabbay, and T. S. E. Maibaum, editors, Handbook of Logic in Computer Science, volume 2, pages 117-309. Clarendon Press, Oxford, 1992.
10. N. Broberg and D. Sands. Flow locks: Towards a core calculus for dynamic flow policies. In In ESOP 2006: the 15th European Symposium on Programming, 2006.
11. J. Cederquist, R. Corin, M. Dekker, S. Etalle, and J. den Hartog. An audit logic for accountability. In The Proceedings of the 6th IEEE International Workshop on Policies for Distributed Systems and Networks, 2005.
12. The Coq Development Team. The Coq Proof Assistant Reference Manual version 8.1, 2007. Available from http://coq.inria.fr/.
13. H. DeYoung, D. Garg, and F. Pfenning. An authorization logic with explicit time. In Proceedings of the 21st IEEE Computer Security Foundations Symposium (CSF-21), June 2008.
14. D. Garg and F. Pfenning. Non-interference in constructive authorization logic. In CSFW '06: Proceedings of the 19th IEEE workshop on Computer Security Foundations, 2006.
15. N. Heintze and J. G. Riecke. The SLam calculus: Programming with secrecy and integrity. In Proc. 25th ACM Symp. on Principles of Programming Languages (POPL), Jan. 1998.
16. L. Jia, J. A. Vaughan, K. Mazurak, J. Zhao, L. Zarko, J. Schorr, and S. Zdancewic. Aura: A programming language for authorization and audit, . In 13th ACM SIGPLAN International Conference on Functional Programming (ICFP), 2008.
17. L. Jia and S. Zdancewic. Encoding information flow in AURA, technical appendix. Technical Report MSCIS- 09-08, University of Pennsylvania, 2009. Available at http://www.seas.upenn.edu/~liminjia/research/papers/auraflow-tr. pdf.
18. P. Li and S. Zdancewic. Downgrading Policies and Relaxed Noninterference. In Proc. ACM Symp. on Principles of Programming Languages (POPL), pages 158-170, 2005.
19. P. Li and S. Zdancewic. Encoding information flow in Haskell. In CSFW '06: Proceedings of the 19th IEEE workshop on Computer Security Foundations, 2006.
20. H. Mantel and A. Reinhard. Controlling the what and where of declassification in language-based security. In In ESOP 2007: the 16th European Symposium on Programming, 2007.
21. A. C. Myers. JFlow: Practical mostly-static information flow control. In Proc. 26th ACM Symp. on Principles of Programming Languages (POPL), Jan. 1999.
22. A. C. Myers, A. Sabelfeld, and S. Zdancewic. Enforcing robust declassification and qualified robustness. Journal of Computer Security, 14(2):157-196, 2006.
23. F. Pottier and V. Simonet. Information flow inference for ML. ACM Trans. Program. Lang. Syst., 25(1):117-158, 2003.
24. A. Russo, K. Claessen, and J. Hughes. A library for lightweight information-flow security in Haskell. In Proceedings of the first ACM SIGPLAN symposium on Haskell, 2008.
25. A. Sabelfeld and A. C. Myers. A Model for Delimited Release. In International Symposium on Software Security, 2003.
26. A. Sabelfeld and A. C. Myers. Language-based informationflow security. IEEE Journal on Selected Areas in Communications, 21(1):5-19, Jan. 2003.
27. A. Sabelfeld and D. Sands. Dimensions and principles of declassification. In CSFW '05: Proceedings of the 18th IEEE workshop on Computer Security Foundations, 2005.
28. V. Simonet. Flow Caml in a nutshell. In Proceedings of the first APPSEM-II workshop, Mar. 2003.
29. J. A. Vaughan, L. Jia, K. Mazurak, and S. Zdancewic. Evidence-based audit. In Proc. of the IEEE Computer Security Foundations Symposium, 2008.
30. D. Volpano, G. Smith, and C. Irvine. A sound type system for secure flow analysis. Journal of Computer Security, 4(3):167-187, 1996.
31. S. Zdancewic and A. C. Myers. Robust declassification. In Proc. of 14th IEEE Computer Security Foundations Workshop, pages 15-23, Cape Breton, Canada, June 2001.
32. S. Zdancewic and A. C. Myers. Secure information flow and CPS. In Proc. of the 10th European Symposium on Programming, Apr. 2001.