Timing- and termination-sensitive secure information flow: Exploring a new approach

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2011, Pages 413-428

  Kashyap, Vineeth ^a   Ben, Wiedermann ^b   Ben, Hardekopf ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b VIRGINIA POLYTECHNIC INSTITUTE AND STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

SENSITIVE DATA;

COVERT CHANNELS; INFORMATION INTEGRITY; NEW APPROACHES; NOVEL STRATEGIES; SECRET INFORMATION; SECURE INFORMATION FLOW; STRONG SECURITIES;

TIMING CIRCUITS;

EID: 80051974927     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2011.19     Document Type: Conference Paper

References (41)

1. M. Abadi, A. Banerjee, N. Heintze, and J. G. Riecke. A core calculus of dependency. In ACM SIGPLAN Symposium on Principles of Programming Languages (POPL), pages 147-160, 1999.
2. J. Agat. Transforming out timing leaks. In ACM SIGPLAN Symposium on Principles of Programming Languages (POPL), pages 40-53, 2000.
3. R. K. Ahuja, T. L. Magnanti, and J. B. Orlin. Network flows: theory, algorithms, and applications. Prentice Hall, 1993.
4. T. Amtoft and A. Banerjee. A logic for information flow analysis with an application to forward slicing of simple imperative programs. Science of Computer Programming (SCP), 64(1):3-28, 2007. (Pubitemid 44765091)
5. A. Askarov, S. Hunt, A. Sabelfeld, and D. Sands. Termination-insensitive noninterference leaks more than just a bit. In European Symposium on Research in Computer Security (ESORICS), pages 333-348, 2008.
6. A. Askarov, A. C. Myers, and D. Zhang. Predictive black-box mitigation of timing channels. In ACM Conference on Computer and Communications Security (CCS), pages 297-307, 2010.
7. G. Barthe, T. Rezk, and M. Warnier. Preventing Timing Leaks Through Transactional Branching Instructions. Electronic Notes Theoretical Computer Science, 153:33-55, May 2006.
8. A. Bortz and D. Boneh. Exposing private information by timing web applications. In International Conference on World Wide Web (WWW), pages 621-628, 2007. (Pubitemid 47582291)
9. G. Boudol and I. Castellani. Noninterference for concurrent programs. In International Colloquium on Automata, Languages and Programming (ICALP), pages 382-395, 2001. (Pubitemid 33300815)
10. D. Brumley and D. Boneh. Remote timing attacks are practical. In USENIX Security Symposium, pages 1-14, 2003.
11. D. E. Denning. A lattice model of secure information flow. Communications of the ACM (CACM), 19(5):236-243, 1976.
12. D. E. Denning and P. J. Denning. Certification of programs for secure information flow. Communications of the ACM (CACM), 20(7):504-513, 1977.
13. D. Devriese and F. Piessens. Non-interference through secure multi-execution. In IEEE Symposium on Security and Privacy, pages 109-124, 2010.
14. D. Devriese and F. Piessens. Personal communication, November 2010.
15. J. F. Dhem, F. Koeune, P. A. Leroux, P. Mestré, J. J. Quisquater, and J. L. Willems. A Practical Implementation of the Timing Attack. In International Conference on Smart Card Research and Applications (CARDIS), pages 167-182, 2000.
16. E. W. Felten and M. A. Schneider. Timing attacks on web privacy. In ACM Conference on Computer and Communications Security (CCS), pages 25-32, 2000. (Pubitemid 32393898)
17. R. Giacobazzi and I. Mastroeni. Timed Abstract Non-interference. In Formal Modeling and Analysis of Timed Systems, volume 3829 of Lecture Notes in Computer Science, chapter 22, pages 289-303. 2005. (Pubitemid 43952402)
18. J. A. Goguen and J. Meseguer. Security policies and security models. In IEEE Symposium on Security and Privacy, pages 11-20, 1982.
19. C. Hammer, J. Krinke, and G. Snelting. Information flow control for Java based on path conditions in dependence graphs. In IEEE International Symposium on Secure Software Engineering, 2006.
20. H. Handschuh and H. M. Heys. A Timing Attack on RC5. In SAC '98: Proceedings of the Selected Areas in Cryptography, pages 306-318, 1999.
21. D. Hedin and D. Sands. Timing aware information flow security for a javacard-like bytecode. Electronic Notes in Theoretical Computer Science, 141(1):163-182, 2005. (Pubitemid 41689008)
22. W. M. Hu. Reducing timing channels with fuzzy time. In IEEE Symposium on Security and Privacy, pages 8-20, 1991.
23. W. M. Hu. Lattice Scheduling and Covert Channels. In IEEE Symposium on Security and Privacy, pages 52-61, 1992.
24. T. Khatiwala, R. Swaminathan, and V. N. Venkatakrishnan. Data Sandboxing: A Technique for Enforcing Confidentiality Policies. In Annual Computer Security Applications Conference (ACSAC), pages 223-234, 2006.
25. P. C. Kocher. Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems. In International Cryptology Conference on Advances in Cryptology (CRYPTO), pages 104-113, 1996. (Pubitemid 126106234)
26. A. C. Myers and B. Liskov. A decentralized model for information flow control. SIGOPS Operating Systems Review (OSR), 31(5):129-142, October 1997. (Pubitemid 127466034)
27. P. R. J. Östergård. A fast algorithm for the maximum clique problem. Discrete Applied Mathematics, 120(1-3):197-207, 2002.
28. P. M. Pardalos and J. Xue. The maximum clique problem. Journal of Global Optimization, 4(3):301-328, 1994.
29. A. Russo, J. Hughes, D. Naumann, and A. Sabelfeld. Closing internal timing channels by transformation. In Asian Computing Science Conference on Advances in Computer Science (ASIAN), pages 120-135, 2007.
30. A. Russo and A. Sabelfeld. Securing interaction between threads and the scheduler. In IEEE Workshop on Computer Security Foundations, pages 177-189, 2006. (Pubitemid 46499726)
31. A. Russo and A. Sabelfeld. Security for multithreaded programs under cooperative scheduling. In International Andrei Ershov Memorial Conference on Perspectives of Systems Informatics (PSI), pages 474-480, 2007.
32. A. Sabelfeld and A. C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1):5-19, 2003.
33. P. Shroff and S. F. Smith. Securing timing channels at runtime. Technical report, Department of Computer Science, The Johns Hopkins University, July 2008.
34. G. Smith and D. Volpano. Secure information flow in a multi-threaded imperative language. In ACM SIGPLAN Symposium on Principles of Programming Languages (POPL), pages 355-364, 1998.
35. S. F. Smith and M. Thober. Refactoring programs to secure information flows. In ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), pages 75-84, 2006. (Pubitemid 44059949)
36. N. Vachharajani, M. J. Bridges, J. Chang, R. Rangan, G. Ottoni, J. A. Blome, G. A. Reis, M. Vachharajani, and D. I. August. Rifle: An architectural framework for user-centric information-flow security. In IEEE/ACM International Symposium on Microarchitecture (MICRO), pages 243-254, 2004. (Pubitemid 40927702)
37. D. Volpano, C. Irvine, and G. Smith. A sound type system for secure flow analysis. Journal of Computing Security, 4(2-3):167-187, 1996.
38. D. Volpano and G. Smith. Eliminating covert flows with minimum typings. In IEEE Workshop on Computer Security Foundations, page 156, 1997.
39. W. H. Wong. Timing attacks on RSA: revealing your secrets through the fourth dimension. Crossroads, 11(3):5, May 2005.
40. S. Zdancewic and A. C. Myers. Robust declassification. In IEEE Workshop on Computer Security Foundations, pages 15-23, 2001. (Pubitemid 32877774)
41. S. Zdancewic and A. C. Myers. Observational determinism for concurrent program security. In IEEE Workshop on Computer Security Foundations, pages 29-43, 2003.