Work

Information Flow Control-by-Construction for an Object-Oriented Language Using Type Modifiers

Year: 2022

Type: preprint

Abstract: In security-critical software applications, confidential information must be prevented from leaking to unauthorized sinks. Static analysis techniques are widespread to enforce a secure information flow by checking a program after construction. A drawback of these systems is that incomplete programs during construction cannot be checked properly. The user is not guided to a secure program by most systems. We introduce IFbCOO, an approach that guides users incrementally to a secure implementation by using refinement rules. In each refinement step, confidentiality or integrity (or both) is guaranteed alongside the functional correctness of the program, such that insecure programs are declined by construction. In this work, we formalize IFbCOO and prove soundness of the refinement rules. We implement IFbCOO in the tool CorC and conduct a feasibility study by successfully implementing case studies.

Source: arXiv (Cornell University)

DOI: 10.48550/arxiv.2208.02672

Authors: Runge, Tobias, Kittelmann, Alexander, Servetto, Marco, Potanin, Alex, Schaefer, Ina

Institutions: Karlsruhe Institute of Technology, Technische Universität Braunschweig, Victoria University of Wellington, Australian National University

Language: English

Topic: Logic, programming, and type systems

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W4290057624

Cites:

Cited by:

Related to: 10