DMCA
Using Access Control for Secure Information Flow in a Java-like Language (2003)
Cached
Download Links
| Venue: | In Proc. 16th IEEE Computer Security Foundations Workshop |
| Citations: | 50 - 7 self |
BibTeX
@INPROCEEDINGS{Banerjee03usingaccess,
author = {Anindya Banerjee and David A. Naumann},
title = {Using Access Control for Secure Information Flow in a Java-like Language},
booktitle = {In Proc. 16th IEEE Computer Security Foundations Workshop},
year = {2003},
pages = {155--169},
publisher = {IEEE Computer Society Press}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Access control mechanisms are widely used with the intent of enforcing confidentiality and other policies, but few formal connections have been made between information flow and access control. Java and C are object-oriented languages that provide fine-grained access control. An access control list specifies local policy by authorizing permissions for principals (code sources) associated with class declarations; a mechanism called stack inspection checks permissions at run time. An example is given to show how this mechanism can be used to achieve confidentiality goals in situations where a single system call serves callers of differing confidentiality levels and dynamic access control prevents release of high information to low callers. A novel static analysis is given which applies to such examples. The analysis is shown to ensure a noninterference property formalizing confidentiality.
Keyphrases
access control secure information flow java-like language run time confidentiality goal class declaration access control mechanism dynamic access control novel static analysis high information information flow noninterference property code source stack inspection check permission low caller single system call object-oriented language confidentiality level formal connection fine-grained access control
