Decentralized Information Flow Control Research Articles

De-centralized information flow control for cloud virtual machines with hybrid AES-ECC and improved meta-heuristic optimization based optimal key generation

De-centralized information flow control for cloud virtual machines with hybrid AES-ECC and improved meta-heuristic optimization based optimal key generation

Improved sun flow optimization (I-SFO) algorithm based de-centralized information flow control for multi-tenant cloud virtual machines

Improved sun flow optimization (I-SFO) algorithm based de-centralized information flow control for multi-tenant cloud virtual machines

DIFCS: A Secure Cloud Data Sharing Approach Based on Decentralized Information Flow Control

Summary In the field of cloud computing, collaboration and data sharing among clouds have dramatically increased. How to protect the security of shared cloud data is being an urgent problem. Based on decentralized information flow control (DIFC) model, this paper presents an approach, DIFC-based data sharing approach (DIFCS), to protect both confidentiality and integrity of shared cloud data. Additionally, this paper designs a privilege protection policy for DIFCS, resulting in its capability of preventing malicious users from modifying privilege. The correctness and security properties of DIFCS are proved by formal analysis and verification, where firstly, DIFCS is formally interpreted into high-level petri net (HLPN) representation and analyzed using Z language, then is automatically verified with SMT-Lib and Z3 solver. The formal analysis and verification results reveal that DIFCS holds the security properties of confidentiality, integrity, authenticity, and privilege tamper-proof. The experimental results further demonstrate the high efficiency of DIFCS.

A Noninterference Model for Mobile OS Information Flow Control and Its Policy Verification

Mobile operating systems such as Android are facing serious security risk. First, they have a large number of users and store a large number of users’ private data, which have become major targets of network attack; second, their openness leads to high security risks; third, their coarse-grained static permission control mechanism leads to a large number of privacy leaks. Recent decentralized information flow control (DIFC) operating systems such as Asbestos, HiStar, and Flume dynamically adjust the label of each process. Asbestos contains inherent covert channels due to this implicit label adjustment. The others close these covert channels through the use of explicit label change, but this impedes communication and increases performance overhead. We present an enhanced implicit label change model (EILCM) for mobile operating systems that can close the known covert channel in these models with implicit label change and supports dynamic constraints on tags for separation of duty. We also formally analyze the reasons why EILCM can close the known covert channels and prove that abstract EILCM systems have the security property of noninterference with declassification by virtue of the model checker tool FDR. We also prove that the problem of EILCM policy verification is NP-complete and propose a backtrack-based search algorithm to solve the problem. Experiments are presented to show that the algorithm is effective.

Tenant-Led Ciphertext Information Flow Control for Cloud Virtual Machines

When users upload their private data to the cloud, they lose control of the data stored in the cloud server. If the cloud system cannot provide an effective security mechanism to protect the data, the consequent data leakage issue will hinder the development of cloud computing. Conventional access control and encryption technologies cannot effectively control the propagation of tenant private data in the system. The mandatory one-way information flow control model is limited by the complexity of the cloud environment, and it is difficult to effectively protect private data stored in the cloud. To solve the above problems, this article proposes a tenant-led ciphertext information flow control method for cloud virtual machines. Through the design of a decentralized information flow control security policy, a secret-domain key management scheme, and a multi-ID-based threshold encryption scheme, the information flow control strategies of taint infection, secret-level reduction, and ability propagation are realized in a ciphertext form, which can effectively prevent malicious users inside and outside the system from illegally reading private data. The feasibility of this method is verified by a security proof and an experiment.

AT-DIFC + : Toward Adaptive and Trust-Aware Decentralized Information Flow Control

Modern software systems and their corresponding architectures are increasingly decentralized, distributed, and dynamic. As a consequence, decentralized mechanisms are required to ensure security in such architectures. Decentralized Information Flow Control (DIFC) is a mechanism to control information flow in distributed systems. This article presents and discusses several improvements to an adaptive decentralized information flow approach that incorporates trust for decentralized systems to provide security. Adaptive Trust-Aware Decentralized Information Flow (AT-DIFC + ) combines decentralized information flow control mechanisms, trust-based methods, and decentralized control architectures to control and enforce information flow in an open, decentralized system. We strengthen our approach against newly discovered attacks and provide additional information about its reconfiguration, decentralized control architectures, and reference implementation. We evaluate the effectiveness and performance of AT-DIFC + on two case studies and perform additional experiments and to gauge the mitigations’ effectiveness against the identified attacks.

Dynamic Control Method for Tenants’ Sensitive Information Flow Based on Virtual Boundary Recognition

In the cloud environment, owing to the large-scale sharing of the upper application instance and the underlying virtual machine resources, the tenants' information flow boundary in the shared virtual machine is fuzzy and difficult to identify. In addition, protection of tenant information flow between processes is inadequate, resulting in the leakage of sensitive information of tenants. Therefore, a dynamic control method for tenants' sensitive information flow based on virtual boundary recognition is proposed. By analyzing the behavior and operation log of tenants, the behavior feature vectors of tenants are constructed, and an automatic recognition algorithm of tenant virtual boundary based on the dynamic spiking neural network is designed. This algorithm can realize dynamic identification of the tenant virtual security boundary when the application service demand changes dynamically. Further, combined with the concept of centralized and decentralized information flow control, a dynamic control method of sensitive information flow is established. The security label is formally defined by using the lattice structure, and the control rules of tenants' information flow and the rules of tenant label encryption-declassification are designed. Thus, the independent, dynamic and secure control of tenants' information flow inside and outside the tenant virtual boundary. Finally, the detailed design of a dynamic security control application system for cloud tenants' sensitive information flow is provided. Experiments confirm that the proposed algorithm can identify the security boundary of tenants more accurately and efficiently than the traditional spiking neural network classification methods. Further, the security and effectiveness of the method is verified by the intransitive noninterference theory and the experiment of information flow control.

CDroid: practically implementation a formal-analyzed CIFC model on Android

Decentralized information flow control (DIFC) operating systems provide mechanisms for applications to handle the secrecy and integrity of their data by themselves. DIFC adapts to the distributed systems well, but not for the centralized authorization systems where an administrator manages all the privileges. For example, Android is full of untrusted third-party applications. A phone user may want to specify what kind of application can deal with what kind of private data by enforcing information flow control. To address this, we proposed a novel formal-described and security-proofed centralized information flow control (CIFC) model. In CIFC, taint tag of private data and capability label of applications are designed to support fine-grained and user-defined information flow control. Differs from DIFC and classic information flow control models, CIFC model controls information flow according to the relation between tag and label rather than the relation between two labels of applications. We use Value-passing Security Process Algebra (VSPA) to clarify the formal semantics of CIFC model. The verification of system equivalence proves that the model guarantees the noninterference security property in virtue of Checker of Persistent Security (CoPS) tool. We also implemented CDroid, a prototype of the CIFC model which can track and control information flow at runtime. CDroid is demonstrated to be an accurate system to achieve the security goal through several function test experiments. Furthermore, CDroid has 5% lead in memory consumption and 17% overhead of runtime performance compared to Android.

Mechanisms of neuroprogression and interventions to predict and arrest it

Decentralized information flow control (DIFC) operating systems provide mechanisms for applications to handle the secrecy and integrity of their data by themselves. DIFC adapts to the distributed systems well, but not for the centralized authorization systems where an administrator manages all the privileges. For example, Android is full of untrusted third-party applications. A phone user may want to specify what kind of application can deal with what kind of private data by enforcing information flow control. To address this, we proposed a novel formal-described and security-proofed centralized information flow control (CIFC) model. In CIFC, taint tag of private data and capability label of applications are designed to support fine-grained and user-defined information flow control. Differs from DIFC and classic information flow control models, CIFC model controls information flow according to the relation between tag and label rather than the relation between two labels of applications. We use Value-passing Security Process Algebra (VSPA) to clarify the formal semantics of CIFC model. The verification of system equivalence proves that the model guarantees the noninterference security property in virtue of Checker of Persistent Security (CoPS) tool. We also implemented CDroid, a prototype of the CIFC model which can track and control information flow at runtime. CDroid is demonstrated to be an accurate system to achieve the security goal through several function test experiments. Furthermore, CDroid has 5% lead in memory consumption and 17% overhead of runtime performance compared to Android.

Fine-grained Privilege Propagation in DIFC Model

In Decentralized Information Flow Control Model, Label is used for marking security level of sensitive data (such as static file, memory data or network packet). Anyone who wants to access the labeled data must obtain relative label first, so authorization is a process that the data owner give data receiver the capability to get the label. Traditionally, most researchers focus on the DIFC model innovation and application, few pay attention to how to disseminate the privilege of adding tag or removing tag. Fine-grained privilege propagation is the foundation for sharing sensitive data securely. In this paper we propose the model of fine-grained privilege propagation. The model provides label privilege granting and revocation in process level and describes four level of authorization for more flexible privilege propagation. The experiments demonstrate that FPPM improves the flexibility of data sharing.

Managing Cloud Security Using Energetic Information Flow Control

Most of the cloud computing solutions used today does not ensure security. Although methods like access control list, firewall and cryptography impose limits on information that is released by the system, they provide no guarantee about information propagation. We propose a Decentralized Information Flow Control (DIFC) that is integrated into the PaaS cloud model. This enhances security by associating labels with the data it protects. This datacentric security mechanism tracks and limits data propagation.

Protecting Cloud Data Using the Decentralized Information Flow Control with Authorization Condition

Protecting Cloud Data Using the Decentralized Information Flow Control with Authorization Condition

Practical Fine-Grained Information Flow Control Using Laminar

Decentralized Information Flow Control (DIFC) is a promising model for writing programs with powerful, end-to-end security guarantees. Current DIFC systems that run on commodity hardware can be broadly categorized into two types: language-level and operating system-level DIFC. Language solutions provide no guarantees against security violations on system resources such as files and sockets. Operating system solutions mediate accesses to system resources but are either inefficient or imprecise at monitoring the flow of information through fine-grained program data structures. This article describes Laminar, the first system to implement DIFC using a unified set of abstractions for OS resources and heap-allocated objects. Programmers express security policies by labeling data with secrecy and integrity labels and access the labeled data in security methods . Laminar enforces the security policies specified by the labels at runtime. Laminar is implemented using a modified Java virtual machine and a new Linux security module. This article shows that security methods ease incremental deployment and limit dynamic security checks by retrofitting DIFC policies on four application case studies. Replacing the applications' ad hoc security policies changes less than 10% of the code and incurs performance overheads from 5% to 56%. Compared to prior DIFC systems, Laminar supports a more general class of multithreaded DIFC programs efficiently and integrates language and OS abstractions.

Building secure systems with LIO (demo)

LIO is a decentralized information flow control (DIFC) system, implemented in Haskell. In this demo proposal, we give an overview of the LIO library and show how LIO can be used to build secure systems. In particular, we show how to specify high-level security policies in the context of web applications, and describe how LIO automatically enforces these policies even in the presence of untrusted code.

Effect: An operational view mechanism for decentralized information flow control

Flume, which implements decentralized information flow control (DIFC), allows a high security level process to “pre-create” secret files in a low security level directory. However, the pre-create mechanism makes some normal system calls unavailable, and moreover, it needs priori knowledge to create a large quantity of objects, which is difficult to estimate in practical operating systems. In this paper, we present an extended Flume file access control mechanism, named Effect, to substitute the mechanism of pre-create, which permits write operations (create, delete, and rename a file) on directories and creates a file access virtual layer that allocates operational views for each process with noninterference properties. In the end, we further present an analysis on the security of Effect. Our work makes it easier for multi-user to share confidential information in decentralized information flow control systems.

Optimal mining on security labels for decentralized information flow control

Decentralized information flow control (DIFC) is a key innovation of traditional information flow control (IFC). When compared with IFC, DIFC provides new features including decentralized declassification, taint-tracking and privilege-transferring. These characteristics make DIFC more applicable than traditional IFC to the control of information flows in systems. This paper presents an optimal approach to the mining of security labels for DIFC. This approach can effectively improve DIFC's applicability and manageability in a wide variety of environments. We firstly design a novel policy description language to express security requirements in DIFC characterized assertions. Next, we prove that the problem of obtaining security labels from DIFC assertions is NP-complete. Based on logic programming and genetic algorithm, the proposed approach finally outputs optimal security labels separately for different DIFC systems in both small and large-scale environments. The objectives of this paper are to address two practical aspects of DIFC: (1) how to express security requirements by using DIFC characterized assertions; (2) how to obtain optimal DIFC labels to satisfy security requirements. The experimental results show that the proposed approach is effective in implementing fine-grained information control according to practical security requirements.

Laminar

Decentralized information flow control (DIFC) is a promising model for writing programs with powerful, end-to-end security guarantees. Current DIFC systems that run on commodity hardware can be broadly categorized into two types: language-level and operating system-level DIFC. Language level solutions provide no guarantees against security violations on system resources, like files and sockets. Operating system solutions can mediate accesses to system resources, but are inefficient at monitoring the flow of information through fine-grained program data structures. This paper describes Laminar, the first system to implement decentralized information flow control using a single set of abstractions for OS resources and heap-allocated objects. Programmers express security policies by labeling data with secrecy and integrity labels, and then access the labeled data in lexically scoped security regions. Laminar enforces the security policies specified by the labels at runtime. Laminar is implemented using a modified Java virtual machine and a new Linux security module. This paper shows that security regions ease incremental deployment and limit dynamic security checks, allowing us to retrofit DIFC policies on four application case studies. Replacing the applications' ad-hoc security policies changes less than 10% of the code, and incurs performance overheads from 1% to 56%. Whereas prior DIFC systems only support limited types of multithreaded programs, Laminar supports a more general class of multithreaded DIFC programs that can access heterogeneously labeled data.

Manageable fine-grained information flow

The continuing frequency and seriousness of security incidents underline the critical importance of application security. Decentralized information flow control (DIFC), a promising tool for improving application security, gives application developers fine-grained control over security policy and privilege management. DIFC developers can partition much application functionality into untrusted components bound by a kernel- or language-enforced security policy. Unless a (usually smaller and less exposed) trusted component is exploited, the effects of an application compromise are contained by the policy. Although system-based DIFC can simultaneously achieve high performance and effective isolation, it offers a challenging programming model. Fine-grained policy specifications are spread over several application pieces. Common programming errors may be indistinguishable from policy exploit attempts, the system cannot expose developers to information about these errors, complicating debugging. Static checking (as in language based systems) and new system primitives can reduce these problems, but for dynamic applications like web servers, they do not eliminate them. In this paper we propose subsystems that make decentralized information flow more manageable. First, a policy description language specifies an application-wide security policy in one localized place; communication restrictions are compiled into lower-level labels. Second, information flow-safe debugging mechanisms let developers debug DIFC applications without violating security policies. Although these mechanisms are preliminary, we demonstrate their effectiveness using applications similar to those developed for Asbestos and other DIFC systems.

Information flow control for standard OS abstractions

Decentralized Information Flow Control (DIFC) is an approach to security that allows application writers to control how data flows between the pieces of an application and the outside world. As applied to privacy, DIFC allows untrusted software to compute with private data while trusted security code controls the release of that data. As applied to integrity, DIFC allows trusted code to protect untrusted software from unexpected malicious inputs. In either case, only bugs in the trusted code, which tends to be small and isolated, can lead to security violations. We present Flume , a new DIFC model that applies at the granularity of operating system processes and standard OS abstractions (e.g., pipes and file descriptors). Flume was designed for simplicity of mechanism, to ease DIFC's use in existing applications, and to allow safe interaction between conventional and DIFC-aware processes. Flume runs as a user-level reference monitor onLinux. A process confined by Flume cannot perform most system calls directly; instead, an interposition layer replaces system calls with IPCto the reference monitor, which enforces data flowpolicies and performs safe operations on the process's behalf. We ported a complex web application (MoinMoin Wiki) to Flume, changingonly 2% of the original code. Performance measurements show a 43% slowdown on read workloadsand a 34% slowdown on write workloads, which aremostly due to Flume's user-level implementation.