Towards a system-wide and transparent security mechanism using language-level information flow control
Towards a system-wide and transparent security mechanism using language-level information flow control
复制标题
使用语言级信息流控制建立全系统透明的安全机制
DOI：
10.1145/1854099.1854107
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
M. Sharifi
中科院分区：
文献类型：
--
作者：
M. R. Azadmanesh;M. Sharifi
操作系统试图使用适当的安全机制（如DAC和MAC）来提供安全的平台。尽管如此，当信息在程序内存空间中流动时，信息保密性并没有完全提供。因此，引入了编程语言级别的安全技术来提供程序内部的安全信息流。现有的编程语言级别的工作是有问题的，因为它们的信息流策略没有集成到底层的系统安全策略中。在本文中，我们提出了一个动态解决方案，用于在Java框架内跟踪和执行信息流策略，该框架与可信操作系统（即SELinux）集成在一起。我们的解决方案侧重于JVM的内部结构，不涉及对Java编程语言的修改。实验结果表明，运行程序的运行时开销是可以承受的。
Operating systems try to provide secure platforms using appropriate security mechanisms like DAC and MAC. In spite of this, information confidentiality is not totally provided when information flows in the program memory space. Programming language level security techniques have thus been introduced to provide secure information flow inside programs. Existing works on programming language level are problematic though because their information flow policies have not been integrated into the underlying system security policies. In this paper we propose a dynamic solution for tracking and enforcing information flow policies inside the Java framework that is integrated with a trusted operating system namely SELinux. Our solution focuses on internal structure of JVM, implicating no modification to Java programming language. Experimental results have shown a bearable runtime overhead on running programs.