mdh.sePublikationer
Ändra sökning
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Value-sensitive Hybrid Information Flow Control for a JavaScript-like Language
Mälardalens högskola, Akademin för innovation, design och teknik, Inbyggda system. Chalmers University of Technology, Sweden.ORCID-id: 0000-0002-6621-8390
Chalmers University of Technology, Sweden.
Chalmers University of Technology, Sweden.
2015 (Engelska)Ingår i: Proceedings of the Computer Security Foundations Workshop, vol. 2015, 2015, s. 351-365Konferensbidrag, Publicerat paper (Refereegranskat)
Abstract [en]

Secure integration of third-party code is one of the prime challenges for securing today’s web. Recent empirical studies give evidence of pervasive reliance on and excessive trust in third-party JavaScript, with no adequate security mechanism to limit the trust or the extent of its abuse. Information flow control is a promising approach for controlling the behavior of third-party code and enforcing confidentiality and integrity policies. While much progress has been made on static and dynamic approaches to information flow control, only recently their combinations have received attention. Purely static analysis falls short of addressing dynamic language features such as dynamic objects and dynamic code evaluation, while purely dynamic analysis suffers from inability to predict side effects in non-performed executions. This paper develops a value-sensitive hybrid mechanism for tracking information flow in a JavaScriptlike language. The mechanism consists of a dynamic monitor empowered to invoke a static component on the fly. This enables us to achieve a sound yet permissive enforcement. We establish formal soundness results with respect to the security policy of noninterference. In addition, we demonstrate permissiveness by proving that we subsume the precision of purely static analysis and by presenting a collection of common programming patterns that indicate that our mechanism has potential to provide more permissiveness than dynamic mechanisms in practice.

Ort, förlag, år, upplaga, sidor
2015. s. 351-365
Nationell ämneskategori
Datorsystem
Identifikatorer
URN: urn:nbn:se:mdh:diva-30486DOI: 10.1109/CSF.2015.31ISI: 000380428500024Scopus ID: 2-s2.0-84961373634ISBN: 978-1-4673-7538-2 (tryckt)OAI: oai:DiVA.org:mdh-30486DiVA, id: diva2:885956
Konferens
28th IEEE Computer Security Foundations Symposium CSF'15, 13-17 Jul 2015, Verona, Italy
Tillgänglig från: 2015-12-21 Skapad: 2015-12-21 Senast uppdaterad: 2019-01-28Bibliografiskt granskad

Open Access i DiVA

Fulltext saknas i DiVA

Övriga länkar

Förlagets fulltextScopus

Personposter BETA

Hedin, Daniel

Sök vidare i DiVA

Av författaren/redaktören
Hedin, Daniel
Av organisationen
Inbyggda system
Datorsystem

Sök vidare utanför DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetricpoäng

doi
isbn
urn-nbn
Totalt: 18 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf