Tight Enforcement of Information-Release Policies for Dynamic Languages
Tight Enforcement of Information-Release Policies for Dynamic Languages
复制标题
严格执行动态语言的信息发布政策
DOI：
--
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
A. Sabelfeld
中科院分区：
文献类型：
--
作者：
Aslan Askarov;A. Sabelfeld
本文研究了以动态语言确保信息发布的问题。我们提出（i）信息释放政策的直观框架，既表达应用程序可以发布的内容，又可以在代码中进行此版本，以及（ii）通过混合机制的紧密而模块化的执行，将监视与in-the-thine相结合-Fly静态分析具有动态代码评估和通信原始的语言。政策框架和执法机制都支持对终止敏感和不敏感的安全策略。
This paper studies the problem of securing information release in dynamic languages. We propose (i) an intuitive framework for information-release policies expressing both what can be released by an application and where in the code this release may take place and (ii) tight and modular enforcement by hybrid mechanisms that combine monitoring with on-the-fly static analysis for a language with dynamic code evaluation and communication primitives. The policy framework and enforcement mechanisms support both termination-sensitive and insensitive security policies.