Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security最新文献

Using Precise Taint Tracking for Auto-sanitization 使用精确的污点跟踪进行自动消毒

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139341

Tejas Saoji, Thomas H. Austin, C. Flanagan

引用次数: 12

Short Paper: Towards Information Flow Reasoning about Real-World C Code 短文:关于真实世界C代码的信息流推理

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139345

Samuel Grütter, Toby C. Murray

引用次数: 2

Simplicity: A New Language for Blockchains 简单:区块链的新语言

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139340

Russell O'Connor

引用次数: 86

CFG Construction Soundness in Control-Flow Integrity 控制流程完整性中的CFG施工稳健性

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139339

Gang Tan, T. Jaeger

引用次数: 8

Encoding DCC in Haskell 在Haskell中编码DCC

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139338

Maximilian Algehed, Alejandro Russo

{"title":"Encoding DCC in Haskell","authors":"Maximilian Algehed, Alejandro Russo","doi":"10.1145/3139337.3139338","DOIUrl":"https://doi.org/10.1145/3139337.3139338","url":null,"abstract":"The seminal work on the Dependency Core Calculus (DCC) shows how monads not only can be used for embedding effects in purely functional languages but also to statically track data dependencies. Such types of analysis have applications in research areas like security, partial evaluation, and slicing, where DCC plays the role of a unifying formalism. For a Haskell programmer, putting DCC into practice raises many interesting conceptual and implementation concerns. Specifically, DCC uses a non-standard bind operator, i.e., with a different type signature than that provided by monads. In fact, embedding such non-standard bind operator opens the door for many design decisions. Furthermore, it is unclear if DCC extends to traditional methods used by Haskell programmers to handle effects (such as monad transformers). In this work, we describe a novel encoding of DCC in Haskell, with a focus on its use for security-although our results also apply to the other domains. We address the concerns mentioned above and show how our implementation of DCC can be seen as a direct translation from its typing rules via the use of closed type families and type classes-two advanced type-system features of Haskell. We also analyze what kind of effects DCC is compatible with and which ones it cannot secure. We also derive an alternative formulation of DCC based on fmap and a corresponding non-standard join.","PeriodicalId":329351,"journal":{"name":"Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security","volume":"96 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-10-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132973316","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 19

Languages for Oblivious Computation 遗忘计算的语言

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139349

M. Hicks

{"title":"Languages for Oblivious Computation","authors":"M. Hicks","doi":"10.1145/3139337.3139349","DOIUrl":"https://doi.org/10.1145/3139337.3139349","url":null,"abstract":"1 OBLIVIOUS COMPUTATION Cloud computing allows users to delegate data storage and computing needs to cloud service providers. Doing so relieves users from the need to purchase and maintain their own computing infrastructure, but requires sharing potentially sensitive data with the provider. Researchers have been exploring how to mitigate the risk of doing so by developing privacy preserving computing technology. The idea is to employ hardware and/or software that can compute a function y = f (x1,x2, ...,xn ) obliviously, meaning that despite producing an answer, the service provider learns nothing about x1, ...,xn or y in the process. Such technology effectively implements a secure abstract machine that receives encrypted inputs, computes the requested function using encrypted memory, and returns an encrypted result, which the client can decrypt. Such an abstract machine might employ cryptographic algorithms and/or secure processors (e.g., FHE [1] or Intel SGX1). While a secure abstract machine stops an attacker from reading sensitive values directly, it does not defeat an attacker who can infer such values from a computation’s side channels, such as its patterns of memory accesses or instruction timings. Indeed, a cloud provider could easily measure such patterns. A countermeasure is to augment the abstract machine to store code and data in oblivious RAM (ORAM) [2]. ORAM is a data structure that regularly changes the mapping between a data block’s logical address and its physical address. While the abstract machine always knows the up-to-date mapping, the adversary does not, and as a result the address trace is indistinguishable from a random sequence. While secure against a snooping adversary, ORAM unfortunately incurs a substantial slowdown in practical situations: each read/write requires additional operations (to update the mapping) that are polylogarithmic in the size of the memory.","PeriodicalId":329351,"journal":{"name":"Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-10-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131835787","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Modular Synthesis of Heap Exploits 堆漏洞的模块化合成

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139346

D. Repel, Johannes Kinder, L. Cavallaro

引用次数: 31

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security 2017年安全编程语言与分析研讨会论文集

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337

Nataliia Bielova, Marco Gaboardi

{"title":"Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security","authors":"Nataliia Bielova, Marco Gaboardi","doi":"10.1145/3139337","DOIUrl":"https://doi.org/10.1145/3139337","url":null,"abstract":"It is our great pleasure to welcome you to the 12th ACM SIGSAC Workshop on Programming Languages and Analysis for Security (PLAS 2017), co-located with the ACM Conference on Computer and Communications Security (CCS). Over its now more than ten-year history, PLAS has provided a unique forum for researchers and practitioners to exchange ideas about programming language and program analysis techniques with the goal of improving the security of software systems. \u0000 \u0000This year, PLAS received a good number of submissions attesting the continued vitality of the community whose work sits at the intersection of programming languages and security. PLAS 2017 welcomed the submission of both long research papers as well as short papers presenting preliminary or exploratory work aiming at generating lively discussions at the workshop. PLAS 2017 attracted 16 submissions-of which, 6 were short papers-from 9 countries (Australia, France, Germany, India, Singapore, Sweden, Taiwan, UK, USA), with authors spanning both academia and industry. \u0000 \u0000PLAS 2017 is delighted to have two excellent invited talks: \u0000Authorization Contracts, Stephen Chong (Harvard University) \u0000Languages for Oblivious Computation, Michael Hicks (University of Maryland)","PeriodicalId":329351,"journal":{"name":"Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security","volume":"204 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-10-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116505661","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Authorization Contracts 授权合约

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139348

Stephen Chong

引用次数: 0

A Sequent Calculus for Counterfactual Reasoning 反事实推理的序贯演算

Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security Pub Date : 2017-10-30 DOI: 10.1145/3139337.3139342

McKenna McCall, L. Loh, Limin Jia

{"title":"A Sequent Calculus for Counterfactual Reasoning","authors":"McKenna McCall, L. Loh, Limin Jia","doi":"10.1145/3139337.3139342","DOIUrl":"https://doi.org/10.1145/3139337.3139342","url":null,"abstract":"Counterfactual conditions such as \"if A were not true, then C would not have been true\" have been formally studied by philosophers for causal claims for decades. Counterfactuals are often used informally in practice for diagnosing systems and identifying errors or misconfigurations. This paper develops a proof theory for counterfactual reasoning of Horn clauses, which have applications in domains including security and database and program analysis. The application to security that this paper focuses on is modeling and reasoning about probing attacks in Datalog-based trust management systems, where an attacker can apply counterfactual reasoning to obtain sensitive information embedded in the system. Our work is inspired by a Hilbert-style axiomatized system for counterfactual reasoning for Horn clauses, which are hard to use to construct proofs or study properties of the system. To alleviate this difficulty, we develop a sequent calculus from first principles. We show that the sequent calculus has cut elimination and is sound and complete with regard to the corresponding Hilbert style axiomatized system. We also show how to construct proofs that model practical counterfactual reasoning scenarios in trust management systems using our sequent calculus rules.","PeriodicalId":329351,"journal":{"name":"Proceedings of the 2017 Workshop on Programming Languages and Analysis for Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-10-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128681193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0