Protecting privacy using the decentralized label model

ABSTRACT

Stronger protection is needed for the confidentiality and integrity of data, because programs containing untrusted code are the rule rather than the exception. Information flow control allows the enforcement of end-to-end security policies, but has been difficult to put into practice. This article describes the decentralized label model, a new label model for control of information flow in systems with mutual distrust and decentralized authority. The model improves on existing multilevel security models by allowing users to declassify information in a decentralized way, and by improving support for fine-grained data sharing. It supports static program analysis of information flow, so that programs can be certified to permit only acceptable information flows, while largely avoiding the overhead of run-time checking. The article introduces the language Jif, an extension to Java that provides static checking of information flow using the decentralized label model.

REFERENCES

• 1: Martín Abadi, Secrecy by Typing inSecurity Protocols, Proceedings of the Third International Symposium on Theoretical Aspects of Computer Software, p.611-638, September 23-26, 1997
• 2: Martín Abadi , Anindya Banerjee , Nevin Heintze , Jon G. Riecke, A core calculus of dependency, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.147-160, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292555]
• 3: Johan Agat, Transforming out timing leaks, Proceedings of the 27th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.40-53, January 19-21, 2000, Boston, MA, USA [doi>10.1145/325694.325702]
• 4: Gregory R. Andrews , Richard P. Reitman, An Axiomatic Approach to Information Flow in Programs, ACM Transactions on Programming Languages and Systems (TOPLAS), v.2 n.1, p.56-76, Jan. 1980 [doi>10.1145/357084.357088]
• 5: BELL, D. E. AND LAPADULA, L. J. 1976. Secure computer systems: Unified exposition and multics interpretation. Tech Rep. ESD-TR-75-306. MITRE Corp., Bedford, MA.
• 6: BIBA, K. 1977. Integrity considerations for secure computer systems. Tech. Rep. ESD-TR-76-372. Electronic Systems Div., Air Force, Hanscom AFB, MA.
• 7: Dorothy E. Denning, A lattice model of secure information flow, Communications of the ACM, v.19 n.5, p.236-243, May 1976 [doi>10.1145/360051.360056]
• 8: Dorothy E. Denning , Peter J. Denning, Certification of programs for secure information flow, Communications of the ACM, v.20 n.7, p.504-513, July 1977 [doi>10.1145/359636.359712]
• 9: U.S. DEPARTMENT OF DEFENSE. 1985. Trusted Computer System Evaluation Criteria. DoD 5200.28-STD.
• 10: FEIERTAG, R. J. 1980. A technique for proving specifications are multilevel secure: Tech. Report CSL-109 (Jan.). Computer Science Laboratory, SRI International, Menlo Park, CA.
• 11: R. J. Feiertag , K. N. Levitt , L. Robinson, Proving multilevel security of a system design, ACM SIGOPS Operating Systems Review, v.11 n.5, p.57-65, November 1977
• 12: FENTON, J. S. 1973. Information protection systems. Ph.D. Dissertation. University of Cambridge, Cambridge, UK.
• 13: FENTON, J. S. 1974. Memoryless subsystems. Computing 17, 2 (May), 143-147.
• 14: E. Ferrari , P. Samarati , E. Bertino , S. Jajodia, Providing flexibility in information flow control for object oriented systems, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.130, May 04-07, 1997
• 15: Riccardo Focardi , Roberto Gorrieri, The Compositional Security Checker: A Tool for the Verification of Information Flow Security Properties, IEEE Transactions on Software Engineering, v.23 n.9, p.550-571, September 1997 [doi>10.1109/32.629493]
• 16: GOGUEN, J. A. AND MESEGUER, J. 1982. Security policies and security models. In Proceedings of the 1982 IEEE Computer Society Symposium on Research in Security and Privacy (Oakland, CA, May). IEEE Computer Society Press, Los Alamitos, CA, 11-20.
• 17: GOGUEN, J. A. AND MESEGUER, J. 1984. Unwinding and inference control. In Proceedings of the IEEE Symposium on Security and Privacy (Apr.). 75-86.
• 18: James Gosling , Bill Joy , Guy L. Steele, The Java Language Specification, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1996
• 19: GRAY, J. W. I. 1990. Probabilistic interference. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 170-179.
• 20: GRAY, J. W. I. 1991. Towards a mathematical foundation for information flow security. In Proceedings of the 1991 IEEE Symposium on Research in Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, CA, 21-34.
• 21: Nevin Heintze , Jon G. Riecke, The SLam calculus: programming with secrecy and integrity, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.365-377, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268976]
• 22: M. H. Kang , I. S. Moskowitz , D. C. Lee, A network version of the Pump, Proceedings of the 1995 IEEE Symposium on Security and Privacy, p.144, May 08-10, 1995
• 23: KARGER, P. A. AND WRAY, J. C. 1991. Storage channels in disk arm optimization. In Proceedings of the 1991 IEEE Symposium on Research in Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, CA.
• 24: Butler Lampson , Martín Abadi , Michael Burrows , Edward Wobber, Authentication in distributed systems: theory and practice, Proceedings of the thirteenth ACM symposium on Operating systems principles, p.165-182, October 13-16, 1991, Pacific Grove, California, United States
• 25: Tim Lindholm , Frank Yellin, Java Virtual Machine Specification, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999
• 26: MCCOLLUM, C. J., MESSING, J. R., AND NOTARGIACOMO, L. 1990. Beyond the pale of MAC and DAC--Defining new forms of access control. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 190-200.
• 27: MCCULLOUGH, D. 1987. Specifications for multi-level security and a hook-up property. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland, CA, May). 161-166.
• 28: M. D. McIlroy , J. A. Reeds, Multilevel security in the UNIX tradition, Software—Practice & Experience, v.22 n.8, p.673-694, Aug. 1992 [doi>10.1002/spe.4380220805]
• 29: MCLEAN, J. 1990. Security models and information flow. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 180-187.
• 30: John McLean, A General Theory of Composition for Trace Sets Closed under Selective Interleaving Functions, Proceedings of the 1994 IEEE Symposium on Security and Privacy, p.79, May 16-18, 1994
• 31: Jonathan K. Millen, Security Kernel validation in practice, Communications of the ACM, v.19 n.5, p.243-250, May 1976 [doi>10.1145/360051.360059]
• 32: MILLEN, J. K. 1981. Information flow analysis of formal specifications. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 3-8.
• 33: MILLEN, J. K. 1987. Covert channel capacity. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland, CA, May).
• 34: Greg Morrisett , David Walker , Karl Crary , Neal Glew, From system F to typed assembly language, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.85-97, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268954]
• 35: Andrew C. Myers, JFlow: practical mostly-static information flow control, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.228-241, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292561]
• 36: Andrew C. Myers , Barbara Liskov, Mostly-static decentralized information flow control, 1999
• 37: MYERS, A. C. AND LISKOV, B. 1998. Complete, safe information flow with decentralized labels. In Proceedings of the 1998 IEEE Computer Society Symposium on Research in Security and Privacy (Oakland, CA, May). IEEE Computer Society Press, Los Alamitos, CA.
• 38: George C. Necula, Proof-carrying code, Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.106-119, January 15-17, 1997, Paris, France [doi>10.1145/263699.263712]
• 39: Jens Palsberg , Peter Ørbæk, Trust in the lambda-Calculus, Proceedings of the Second International Symposium on Static Analysis, p.314-329, September 25-27, 1995
• 40: François Pottier , Sylvain Conchon, Information flow inference for free, Proceedings of the fifth ACM SIGPLAN international conference on Functional programming, p.46-57, September 2000
• 41: Ravi S. Sandhu, Role Hierarchies and Constraints for Lattice-Based Access Controls, Proceedings of the 4th European Symposium on Research in Computer Security: Computer Security, p.65-79, September 25-27, 1996
• 42: Geoffrey Smith , Dennis Volpano, Secure information flow in a multi-threaded imperative language, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.355-364, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268975]
• 43: STOUGHTON, A. 1981. Access flow: A protection model which integrates access control and information flow. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 9-18.
• 44: SUTHERLAND, D. 1986. A model of information. In Proceedings on 9th National Security Conference (Gaithersburg, MD). 175-183.
• 45: Dennis Volpano , Cynthia Irvine , Geoffrey Smith, A sound type system for secure flow analysis, Journal of Computer Security, v.4 n.2-3, p.167-187, Jan. 1996
• 46: WITTBOLD, J. T. AND JOHNSON, D. M. 1990. Information flow in nondeterministic systems. In Proceedings of the IEEE Symposium on Research in Security and Privacy (Oakland, CA). IEEE Computer Society Press, Los Alamitos, CA, 144-161.
• 47: A. Zakinthinos , E. S. Lee, A general theory of security properties, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.94, May 04-07, 1997

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Information flow controls

General Terms:
Languages, Security

Keywords:
confidentiality, declassification, downgrading, end-to-end, information flow controls, integrity, lattice, policies, principals, roles, type checking