CPL - Chalmers Publication Library
| Utbildning | Forskning | Styrkeområden | Om Chalmers | In English In English Ej inloggad.

Securing Class Initialization in Java-like Languages

Willard Rafnsson (Institutionen för data- och informationsteknik, Programvaruteknik (Chalmers)) ; K. Nakata ; Andrei Sabelfeld (Institutionen för data- och informationsteknik, Programvaruteknik (Chalmers))
IEEE Transactions on Dependable and Secure Computing (1545-5971). Vol. 10 (2013), 1, p. 1-13.
[Artikel, refereegranskad vetenskaplig]

Language-based information-flow security is concerned with specifying and enforcing security policies for information flow via language constructs. Although much progress has been made on understanding information flow in object-oriented programs, little attention has been given to the impact of class initialization on information flow. This paper turns the spotlight on security implications of class initialization. We reveal the subtleties of information propagation when classes are initialized, and demonstrate how these flows can be exploited to leak information through error recovery. Our main contribution is a type-and-effect system which tracks these information flows. The type system is parameterized by an arbitrary lattice of security levels. Flows through the class hierarchy and dependencies in field initializers are tracked by typing class initializers wherever they could be executed. The contexts in which each class can be initialized are tracked to prevent insecure flows of out-of-scope contextual information through class initialization statuses and error recovery. We show that the type system enforces termination-insensitive noninterference.

Nyckelord: Information flow control, program analysis, information-flow, bytecode verification, noninterference, programs



Denna post skapades 2013-01-24. Senast ändrad 2016-07-25.
CPL Pubid: 172126

 

Läs direkt!


Länk till annan sajt (kan kräva inloggning)


Institutioner (Chalmers)

Institutionen för data- och informationsteknik, Programvaruteknik (Chalmers)

Ämnesområden

Datavetenskap (datalogi)
Programvaruteknik

Chalmers infrastruktur

Relaterade publikationer

Denna publikation ingår i:


Securing Interactive Systems