Fine-Grained Information Flow Analysis and Enforcement in a Java Virtual Machine
Fine-Grained Information Flow Analysis and Enforcement in a Java Virtual Machine
复制标题
Java 虚拟机中的细粒度信息流分析和执行
DOI：
--
复制
发表时间：
2007
期刊：
影响因子：
--
通讯作者：
M. Franz
中科院分区：
文献类型：
--
作者：
Deepak Chandra;M. Franz
我们为 Java 虚拟机实现了一个信息流框架，该框架结合了静态和动态技术，不仅捕获显式流，还捕获控制流产生的隐式流。与在编译时冻结策略的其他方法不同，我们的系统真正将策略和执行机制分开，从而即使在程序运行时也允许策略更改。在执行之前，我们运行静态分析，用信息流信息注释可执行文件。在执行过程中，我们使用注释来安全地更新位于替代执行路径中的变量标签，同时强制执行当前的策略。我们的框架不需要访问源代码，并且完全向后兼容现有的 Java 类文件。初步基准测试结果表明，对于许多应用程序领域来说，像我们这样的信息流技术的运行时开销完全在可接受的范围内。
We have implemented an information flow framework for the Java virtual machine that combines static and dynamic techniques to capture not only explicit flows, but also implicit ones resulting from control flow. Unlike other approaches that freeze policies at time of compilation, our system truly separates policy and enforcement mechanism and thereby permits policy changes even while a program is running. Ahead of execution, we run a static analysis that annotates an executable with information-flow information. During execution, we then use the annotations to safely update the labels of variables that lie in alternative paths of execution while enforcing the policy currently in place. Our framework doesn't require access to source code and is fully backward-compatible with existing Java class files. Preliminary benchmark results suggest that the run-time overhead of information flow techniques such as ours is well within acceptable range for many application domains.