Secure multi-execution through static program transformation

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7273 LNCS, Issue , 2012, Pages 186-202

  Barthe, Gilles ^a   Crespo, Juan Manuel ^a   Devriese, Dominique ^b   Piessens, Frank ^b   Rivas, Exequiel ^a  

^a IMDEA SOFTWARE INSTITUTE   (Spain)

^b UNIVERSITY OF LEUVEN   (Belgium)

Author keywords

[No Author keywords available]

Indexed keywords

ALTERNATIVE APPROACH; CODE EVALUATION; DYNAMIC TECHNIQUES; IMPLEMENTATION TECHNIQUES; INPUT/OUTPUT; INPUT/OUTPUT OPERATIONS; JAVASCRIPT; PROGRAM TRANSFORMATIONS; PROOF ASSISTANT; PROTOTYPE IMPLEMENTATIONS; RUNTIME ENVIRONMENTS; RUNTIMES; SECURE INFORMATION FLOW; SECURITY LEVEL; STATIC PROGRAM; WEB APPLICATION;

HIGH LEVEL LANGUAGES; SEMANTICS;

NETWORK SECURITY;

EID: 84862731005     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-30793-5_12     Document Type: Conference Paper

References (31)

1. Askarov, A., Sabelfeld, A.: Tight enforcement of information-release policies for dynamic languages. In: CSF, pp. 43-59 (2009)
2. Austin, T., Flanagan, C.: Multiple facets for dynamic information flow. In: POPL (2012)
3. Austin, T.H., Flanagan, C.: Permissive dynamic information flow analysis. In: PLAS (2010)
4. Barthe, G., Crespo, J.M., Devriese, D., Piessens, F., Rivas, E.: Secure multi-execution through static program transformation: extended version. Technical Report CW620, Department of Computer Science, Katholieke Universiteit Leuven (2012)
5. Barthe, G., D'Argenio, P.R., Rezk, T.: Secure information flow by self-composition. In: CSFW, pp. 100-114 (2004)
6. Bielova, N., Devriese, D., Massacci, F., Piessens, F.: Reactive non-interference for a browser model. In: NSS (2011)
7. Birgisson, A., Russo, A., Sabelfeld, A.: Capabilities for information flow. In: PLAS (2011)
8. Capizzi, R., Longo, A., Venkatakrishnan, V.N., Prasad Sistla, A.: Preventing information leaks through shadow executions. In: ACSAC (2008)
9. Cavadini, S.: Secure slices of insecure programs. In: ASIACCS, pp. 112-122 (2008)
10. Chudnov, A., Naumann, D.A.: Information flow monitor inlining. In: CSF, pp. 200-214 (2010)
11. Chugh, R., Meister, J.A., Jhala, R., Lerner, S.: Staged information flow for Javascript. In: PLDI (2009)
12. Cristiá, M., Mata, P.: Runtime enforcement of noninterference by duplicating processes and their memories. In: WSEGI 2009 (2009)
13. Crockford, D.: Adsafe (December 2009), http://www.adsafe.org/
14. Devriese, D., Piessens, F.: Noninterference through secure multi-execution. In: IEEE Symposium on Security and Privacy, pp. 109-124 (2010)
15. Facebook. Fbjs (2011), http://developers.facebook.com/docs/fbjs/
16. Le Guernic, G.: Confidentiality Enforcement Using Dynamic Information Flow Analyses. PhD thesis, Kansas State University (2007)
17. Heintze, N., Riecke, J.G.: The SLam calculus: programming with secrecy and integrity. In: Proc. ACM Symp. on Principles of Programming Languages, pp. 365-377 (January 1998)
18. Jaskelioff, M., Russo, A.: Secure multi-execution in haskell. In: PSI (2011)
19. Kashyap, V., Wiedermann, B., Hardekopf, B.: Timing- and termination-sensitive secure information flow: Exploring a new approach. In: Proceedings of the 2011 IEEE Symposium on Security and Privacy, SP 2011, pp. 413-428. IEEE Computer Society, Washington, DC (2011)
20. Louw, M.T., Ganesh, K.T., Venkatakrishnan, V.N.: Adjail: Practical enforcement of confidentiality and integrity policies on web advertisements. In: USENIX Security Symposium, pp. 371-388 (2010)
21. Maffeis, S., Mitchell, J.C., Taly, A.: Isolating JavaScript with Filters, Rewriting, and Wrappers. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 505-522. Springer, Heidelberg (2009)
22. Maffeis, S., Mitchell, J.C., Taly, A.: Object capabilities and isolation of untrusted web applications. In: IEEE Symposium on Security and Privacy, pp. 125-140 (2010)
23. Miller, M.S., Samuel, M., Laurie, B., Awad, I., Stay, M.: Caja: Safe active content in sanitized javascript (January 2008), http://google-caja. googlecode.com/files/caja-spec-2008-01-15.pdf
24. Myers, A.C.: JFlow: Practical mostly-static information flow control. In: Proc. ACM Symp. on Principles of Programming Languages, pp. 228-241 (January 1999)
25. Richards, G., Hammer, C., Burg, B., Vitek, J.: The Eval That Men Do. In: Mezini, M. (ed.) ECOOP 2011. LNCS, vol. 6813, pp. 52-78. Springer, Heidelberg (2011)
26. Russo, A., Sabelfeld, A.: Securing timeout instructions in web applications. In: CSF, pp. 92-106 (2009)
27. Russo, A., Sabelfeld, A., Chudnov, A.: Tracking Information Flow in Dynamic Tree Structures. In: Backes,M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 86-103. Springer, Heidelberg (2009)
28. Sabelfeld, A., Myers, A.C.: Language-based information-flow security. JSAC 21, 5-19 (2003)
29. Sabelfeld, A., Russo, A.: From Dynamic to Static and Back: Riding the Roller Coaster of Information-Flow Control Research. In: Pnueli, A., Virbitskaite, I., Voronkov, A. (eds.) PSI 2009. LNCS, vol. 5947, pp. 352-365. Springer, Heidelberg (2010)
30. Taly, A., Erlingsson, U., Miller, M.S., Mitchell, J.C., Nagra, J.: Automated analysis of security-critical javascript apis. In: IEEE Symposium on Security and Privacy (2011)
31. Volpano, D., Irvine, C., Smith, G.: A sound type system for secure flow analysis. Journal of Computer Security 4(2/3), 167-188 (1996)