mdh.sePublikasjoner
Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Value-sensitive Hybrid Information Flow Control for a JavaScript-like Language
Mälardalens högskola, Akademin för innovation, design och teknik, Inbyggda system. Chalmers University of Technology, Sweden.ORCID-id: 0000-0002-6621-8390
Chalmers University of Technology, Sweden.
Chalmers University of Technology, Sweden.
2015 (engelsk)Inngår i: Proceedings of the Computer Security Foundations Workshop, vol. 2015, 2015, s. 351-365Konferansepaper, Publicerat paper (Fagfellevurdert)
Abstract [en]

Secure integration of third-party code is one of the prime challenges for securing today’s web. Recent empirical studies give evidence of pervasive reliance on and excessive trust in third-party JavaScript, with no adequate security mechanism to limit the trust or the extent of its abuse. Information flow control is a promising approach for controlling the behavior of third-party code and enforcing confidentiality and integrity policies. While much progress has been made on static and dynamic approaches to information flow control, only recently their combinations have received attention. Purely static analysis falls short of addressing dynamic language features such as dynamic objects and dynamic code evaluation, while purely dynamic analysis suffers from inability to predict side effects in non-performed executions. This paper develops a value-sensitive hybrid mechanism for tracking information flow in a JavaScriptlike language. The mechanism consists of a dynamic monitor empowered to invoke a static component on the fly. This enables us to achieve a sound yet permissive enforcement. We establish formal soundness results with respect to the security policy of noninterference. In addition, we demonstrate permissiveness by proving that we subsume the precision of purely static analysis and by presenting a collection of common programming patterns that indicate that our mechanism has potential to provide more permissiveness than dynamic mechanisms in practice.

sted, utgiver, år, opplag, sider
2015. s. 351-365
HSV kategori
Identifikatorer
URN: urn:nbn:se:mdh:diva-30486DOI: 10.1109/CSF.2015.31ISI: 000380428500024Scopus ID: 2-s2.0-84961373634ISBN: 978-1-4673-7538-2 (tryckt)OAI: oai:DiVA.org:mdh-30486DiVA, id: diva2:885956
Konferanse
28th IEEE Computer Security Foundations Symposium CSF'15, 13-17 Jul 2015, Verona, Italy
Tilgjengelig fra: 2015-12-21 Laget: 2015-12-21 Sist oppdatert: 2019-01-28bibliografisk kontrollert

Open Access i DiVA

Fulltekst mangler i DiVA

Andre lenker

Forlagets fulltekstScopus

Personposter BETA

Hedin, Daniel

Søk i DiVA

Av forfatter/redaktør
Hedin, Daniel
Av organisasjonen

Søk utenfor DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric

doi
isbn
urn-nbn
Totalt: 18 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf