Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security最新文献

A Language-Based Approach to Secure Quorum Replication 基于语言的安全仲裁复制方法

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637117

Lantian Zheng, A. Myers

引用次数: 9

Monitoring Reactive Systems with Dynamic Channels 用动态通道监测无功系统

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637120

D. Zanarini, Mauro Jaskelioff

{"title":"Monitoring Reactive Systems with Dynamic Channels","authors":"D. Zanarini, Mauro Jaskelioff","doi":"10.1145/2637113.2637120","DOIUrl":"https://doi.org/10.1145/2637113.2637120","url":null,"abstract":"Given the increasingly sensitive data that web applications deal with, a lot of attention has been put into their security. Dynamic methods for ensuring confidentiality of secret data, such as monitors, are usually preferred due to their permissiveness and ability to adapt to dynamic features of web languages. One dynamic approach to confidentiality is through secure multi-execution, a technique which transforms programs into secure ones. A recent refinement of this technique led to a monitor for reactive systems such as web applications which is precise, in the sense that it raises an alarm exactly when a security condition is violated, and transparent, in the sense that the semantics of secure programs is preserved. A limitation of this and other approaches based on secure multi-execution is that there is a fixed set of channels with a fixed security level. However, most web applications create channels dynamically, even by doing something as trivial as adding a button to a page. Moreover, the security level of such new channel would be chosen dynamically. In this work, we overcome the limitation of assuming a fixed set of channels and introduce a model of reactive systems with dynamic channels and present a precise and transparent monitor for it.","PeriodicalId":336079,"journal":{"name":"Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security","volume":"678 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-07-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116106331","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

You Sank My Battleship!: A Case Study in Secure Programming 你击沉了我的战舰!:安全编程的案例研究

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637115

Alley Stoughton, Andrew Johnson, Samuel Beller, Karishma Chadha, Dennis Chen, Kenneth Foner, M. Zhivich

引用次数: 7

Operational Semantics for Secure Interoperation 安全互操作的操作语义

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637118

Adriaan Larmuseau, Marco Patrignani, D. Clarke

引用次数: 4

Generalizing Permissive-Upgrade in Dynamic Information Flow Analysis 动态信息流分析中权限升级的概化

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637116

Abhishek Bichhawat, Vineet Rajani, D. Garg, Christian Hammer

{"title":"Generalizing Permissive-Upgrade in Dynamic Information Flow Analysis","authors":"Abhishek Bichhawat, Vineet Rajani, D. Garg, Christian Hammer","doi":"10.1145/2637113.2637116","DOIUrl":"https://doi.org/10.1145/2637113.2637116","url":null,"abstract":"Preventing implicit information flows by dynamic program analysis requires coarse approximations that result in false positives, because a dynamic monitor sees only the executed trace of the program. One widely deployed method is the no-sensitive-upgrade check, which terminates a program whenever a variable's taint is upgraded (made more sensitive) due to a control dependence on tainted data. Although sound, this method is restrictive, e.g., it terminates the program even if the upgraded variable is never used subsequently. To counter this, Austin and Flanagan introduced the permissive-upgrade check, which allows a variable upgrade due to control dependence, but marks the variable \"partially-leaked\". The program is stopped later if it tries to use the partially-leaked variable. Permissive-upgrade handles the dead-variable assignment problem and remains sound. However, Austin and Flanagan develop permissive-upgrade only for a two-point (low-high) security lattice and indicate a generalization to pointwise products of such lattices. In this paper, we develop a non-trivial and non-obvious generalization of permissive-upgrade to arbitrary lattices. The key difficulty lies in finding a suitable notion of partial leaks that is both sound and permissive and in developing a suitable definition of memory equivalence that allows an inductive proof of soundness.","PeriodicalId":336079,"journal":{"name":"Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security","volume":"94 21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-07-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129071950","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 26

Building Secure Systems with LIO (Demo) 使用LIO构建安全系统(演示)

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637121

D. Stefan, David Mazières

引用次数: 0

Paragon: Programming with Information Flow Control (Demo) 范例:信息流控制编程(演示)

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637122

Niklas Broberg, B. V. Delft, David Sands

引用次数: 0

To Dream the Impossible Dream: Toward Security Analysis for JavaScript 做不可能的梦:JavaScript的安全分析

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2639514

Julian T Dolby

引用次数: 0

Domain-Polymorphic Programming of Privacy-Preserving Applications 隐私保护应用的域多态规划

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 2014-07-28 DOI: 10.1145/2637113.2637119

D. Bogdanov, Peeter Laud, Jaak Randmets

{"title":"Domain-Polymorphic Programming of Privacy-Preserving Applications","authors":"D. Bogdanov, Peeter Laud, Jaak Randmets","doi":"10.1145/2637113.2637119","DOIUrl":"https://doi.org/10.1145/2637113.2637119","url":null,"abstract":"Secure Multi-party Computation (SMC) is seen as one of the main enablers for secure outsourcing of computation. Currently, there are many different SMC techniques (garbled circuits, secret sharing, homomorphic encryption, etc.) and none of them is clearly superior to others in terms of efficiency, security guarantees, ease of implementation, etc. For maximum efficiency, and for obeying the trust policies, a privacy-preserving application may wish to use several different SMC techniques for different operations it performs. A straightforward implementation of this application may result in a program that (i) contains a lot of duplicated code, differing only in the used SMC technique; (ii) is difficult to maintain, if policies or SMC implementations change; and (iii) is difficult to reuse in similar applications using different SMC techniques. In this paper, we propose a programming language called SecreC with associated compilation techniques for simple orchestration of multiple SMC techniques and multiple protection domains. It is a simple imperative language with function calls where the types of data items are annotated with protection domains and where the function declarations may be domain-polymorphic. This allows most of the program code working with private data to be written in a SMC-technique-agnostic manner. It also allows rapid deployment of new SMC techniques and implementations in existing applications. We have implemented the compiler for the language, integrated it with Sharemind SMC framework, and are currently using it for new privacy-preserving applications.","PeriodicalId":336079,"journal":{"name":"Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security","volume":"67 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-07-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134006727","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 49

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security 第九届安全编程语言与分析研讨会论文集

Proceedings of the Ninth Workshop on Programming Languages and Analysis for Security Pub Date : 1900-01-01 DOI: 10.1145/2637113

Alejandro Russo, Omer Tripp

引用次数: 0