mdh.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Value-sensitive Hybrid Information Flow Control for a JavaScript-like Language
Mälardalen University, School of Innovation, Design and Engineering, Embedded Systems. Chalmers University of Technology, Sweden.ORCID iD: 0000-0002-6621-8390
Chalmers University of Technology, Sweden.
Chalmers University of Technology, Sweden.
2015 (English)In: Proceedings of the Computer Security Foundations Workshop, vol. 2015, 2015, 351-365 p.Conference paper, Published paper (Refereed)
Abstract [en]

Secure integration of third-party code is one of the prime challenges for securing today’s web. Recent empirical studies give evidence of pervasive reliance on and excessive trust in third-party JavaScript, with no adequate security mechanism to limit the trust or the extent of its abuse. Information flow control is a promising approach for controlling the behavior of third-party code and enforcing confidentiality and integrity policies. While much progress has been made on static and dynamic approaches to information flow control, only recently their combinations have received attention. Purely static analysis falls short of addressing dynamic language features such as dynamic objects and dynamic code evaluation, while purely dynamic analysis suffers from inability to predict side effects in non-performed executions. This paper develops a value-sensitive hybrid mechanism for tracking information flow in a JavaScriptlike language. The mechanism consists of a dynamic monitor empowered to invoke a static component on the fly. This enables us to achieve a sound yet permissive enforcement. We establish formal soundness results with respect to the security policy of noninterference. In addition, we demonstrate permissiveness by proving that we subsume the precision of purely static analysis and by presenting a collection of common programming patterns that indicate that our mechanism has potential to provide more permissiveness than dynamic mechanisms in practice.

Place, publisher, year, edition, pages
2015. 351-365 p.
National Category
Computer Systems
Identifiers
URN: urn:nbn:se:mdh:diva-30486DOI: 10.1109/CSF.2015.31ISI: 000380428500024Scopus ID: 2-s2.0-84956497593ISBN: 978-1-4673-7538-2 (print)OAI: oai:DiVA.org:mdh-30486DiVA: diva2:885956
Conference
28th IEEE Computer Security Foundations Symposium CSF'15, 13-17 Jul 2015, Verona, Italy
Available from: 2015-12-21 Created: 2015-12-21 Last updated: 2016-08-18Bibliographically approved

Open Access in DiVA

No full text

Other links

Publisher's full textScopus

Authority records BETA

Hedin, Daniel

Search in DiVA

By author/editor
Hedin, Daniel
By organisation
Embedded Systems
Computer Systems

Search outside of DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 7 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf