Illegal Information Flow Research Articles

The area-efficient gate level information flow tracking schemes of digital circuit with multi-level security lattice

The Gate Level Information Flow Tracking (GLIFT) is an effective method to uphold the information security for high-assurance digital circuits. The GLIFT method associates a security label with each data bit and monitors these labels to expose the illegal information flow in the circuit under tracking. However, the label propagation usually consumes a significant area overhead, especially for the multi-level security lattices. This work aims to reduce the area cost of the GLIFT logic to enhance its applicability. A new implementation technique of GLIFT logic of basic gates is proposed by introducing the logic operation ‘minus’. A decoupling-encoding technique of the security labels is also proposed to simplify the GLIFT logic. Furthermore, three improved GLIFT schemes are introduced for different scenarios based on these two techniques. These improved schemes are applied to some ISCAS’85 benchmarks. The evaluation results show that the improved schemes only consume 38.90%, 39.84% and 29.16% area of that of the original GLIFT scheme on average, respectively.

ОСОБЕННОСТИ ПРОГРАММНОЙ АРХИТЕКТУРЫ ЯЗЫКОВОЙ ПЛАТФОРМЫ PLIF ДЛЯ АНАЛИЗА БЕЗОПАСНОСТИ ИНФОРМАЦИОННЫХ ПОТОКОВ В АВТОМАТИЗИРОВАННЫХ СИСТЕМАХ

A lot of research in the field of formal security models have been conducted so far. Information flow control in automated systems software represents one of important directions. Appropriate mechanisms are being investigated in attempt to embed them into modern programming platforms designated for system and application software creation. Today all such studies are of academic type, they have theoretical meaning and usually end up at stage of prototype. According to those authors the main problem in adopting such mechanisms for industrial use and including respective steps into security development lifecycle is complexity of manual code markup with security labels and security warnings checking. We present a new platform for detecting illegal information flows in database program units and outline the respective testing procedure which explicitly separates the responsibilities of developers from that of security analysts.

Capability token selection algorithms to implement lightweight protocols

The IoT (Internet of Things) is now one of the most significant infrastructure and has to be secure against malicious accesses. Especially, it is critical to make devices secure in the IoT. In the CBAC (Capability-Based Access Control) model adopted to the IoT, device owners issue subjects capability tokens, i.e. a set of access rights on objects in devices. Objects in devices are data resource manipulated by subjects. Data are exchanged among subjects and objects through manipulating objects. Here, if subjects attempt to manipulate objects in accordance with the capability tokens issued, the subjects can get data which the subjects are not authorized to get, i.e. illegal information flow and late information flow occur. In our previous studies, protocols are implemented to prevent both illegal and late types of information flows from occurring. Here, operations implying such information flows are interrupted. However, the request processing time gets longer as the number of capability tokens used increases. In this paper, an MRCTSD (Minimum Required Capability Token Selection for Devices) algorithm is newly proposed to reduce the number of capability tokens used. In the evaluation, it is shown that the request processing times and the numbers of capability tokens used in the lightweight protocols realized with the MRCTSD algorithm are shorter and smaller than the conventional protocols, respectively.

Time‐based legality of information flow in the capability‐based access control model for the Internet of Things

SummaryThe Internet of Things is composed of sensor and actuator devices. Devices have to be securely accessed by subjects. In this article, we take the capability‐based access control (CBAC) model where a subject is issued a capability token to manipulate a device by a device owner. In the CBAC model, information which a subject is not allowed to get may illegally flow to the subject. Hence, the operation interruption (OI) protocol to prevent illegal information flow is proposed in our previous studies. However, although a subject is not allowed to get data at time , the subject can get the data later than the time . Here, the data come to the subject later than expected by the subject to get the data, that is, the information flows late to the subject. In this article, we newly propose a time‐based OI (TBOI) protocol to prevent not only illegal information flow but also late information flow. Here, operations implying illegal or late information flow are interrupted, that is, not performed at devices. In the evaluation, we show not only illegal information flow but also late information flow are prevented in the TBOI protocol differently from the OI protocol.

A Cloud Computing Security Model Based on Noninterference

In cloud computing, the risk of data leakage exists between users and virtual machines. Whether it is direct or indirect data leakage, it can be regarded as illegal information flow. Methods such as access control models can control the information flow rather than the covert information flow. Therefore, it needs to use the noninterference models to detect the existence of illegal information flow in cloud computing. Typical noninterference models are not suitable to verificate information flow in cloud computing. When concurrent access actions execute in the cloud architecture, security domains do not affect each other, because there is no information flow between security domains. Based on this, we propose noninterference for cloud architecture in which concurrent access and sequential access coexist. When the sequential actions execute, the information flow between security domains can flow in accordance with established rules. When concurrent access actions execute, there should not be the information flow between security domains.

A flexible read-write abortion protocol with role safety concept to prevent illegal information flow

In information systems, illegal information flow among objects has to be prevented. A transaction illegally reads data in an object if the object includes data in other objects which are not allowed to be read. In our previous studies, the FRWA-R (flexible read-write-abortion with role sensitivity) and FRWA-O (object sensitivity) protocols are proposed to prevent illegal information flow. Here, a transaction aborts with some probability once illegally reading data in an object. The abortion probability depends on the sensitivity of roles which the transaction holds and objects in which the transaction illegally reads data. The role sensitivity and object sensitivity show how many transactions which hold the role and illegally read data in the object abort after illegally reading data in the object, respectively. Here, the sensitivity just monotonically increases each time a transaction aborts. In this paper, we propose a new safety concept of a role and an FRWA-RS (FRWA with role safety) protocol. Here, the safety of a role increases and decreases each time a transaction holding the role commits and aborts by issuing an illegal read operation, respectively. A transaction with safer roles aborts with smaller probability. In the evaluation, we show fewer and more numbers of transactions abort in the FRWA-RS protocol than the RWA protocol and than the WA protocol, respectively, and transactions are more efficiently performed than the WA protocol.

Sensitivity-based synchronisation protocol to prevent illegal information flow among objects

In information systems, a transaction may illegally read data stored in an object, which the transaction is not allowed to read. A transaction illegally writes data to an object after issuing illegal read. The write-abortion (WA), read-write-abortion (RWA) and flexible RWA (FRWA) protocols to prevent illegal information flow are proposed in our previous papers. In the WA and RWA, a transaction is aborted once issuing an illegal write and illegal read, respectively. In the WA, some reads are meaninglessly performed. In the RWA, some reads are lost. In the FRWA, a transaction is aborted with some probability once issuing illegal read. We newly introduce an object sensitivity concept to decide on the abortion probability. In the evaluation, the execution time of each transaction in the FRWA with object sensitivity is shorter than the WA and more number of reads can be performed than the RWA.

Specification and static enforcement of scheduler-independent noninterference in a middleweight Java

We introduce a new timing covert channel that arises from the interplay between multithreading and object orientation. This example motivates us to explore the root of the problem and to devise a mechanism for preventing such errors. In doing so, we first add multithreading constructs to Middleweight Java, a subset of the Java programming language with a fairly rich set of features. A noninterference property is then presented which basically demands program executions be equivalent in the view of whom observing final public values in environments using the so-called high-independent schedulers. It is scheduler-independent in the sense that no matter which scheduler is employed, the executions of the program satisfying the property do not lead to illegal information flows in the form of explicit, implicit, or timing channels. We also give a provably sound type-based static mechanism to enforce the proposed property.

A read-write abortion protocol to prevent illegal information flow in role-based access control systems

In information systems, a transaction may illegally read data stored in an object which the transaction is not allowed to read is stored in the object. A transaction illegally writes data to an object after issuing illegal read. A transaction suspiciously reads data in a suspicious object whose data is not allowed to flow to some object. A transaction impossibly writes data to an object after issuing suspicious read. In our previous studies, the write-abortion (WA) role-based synchronisation (RBS) and object-based synchronisation (OBS) protocols are proposed where a transaction illegally or impossibly writes data to objects is aborted. In this paper, we newly propose a pair of read-write-abortion (RWA) RBS and OBS protocols where a transaction is aborted only if the transaction issues an illegal read or impossible write to an object. In the evaluation, the execution time of each transaction in RWA protocols is shorter than the WA protocols.

A write abortion-based protocol in role-based access control systems

In information systems, data in an object may illegally flow into another object if transactions manipulate the objects. In our previous studies, the read-abortion-based role-based synchronisation (RA-RBS) and object-based synchronisation (RA-OBS) protocols are discussed to prevent illegal information flow in the role-based access control (RBAC) model. Illegal read operations mean read operations which might imply illegal information flow. Here, transactions which issue illegal read operations are aborted. In this paper, we consider a unique object whose data is not allowed to flow to another object. An illegal write is defined to be a write operation which a transaction issues after reading a unique object or illegally reading an object. Each transaction reads objects but is aborted if the transaction illegally writes an object. Two types of write-abortion (WA)-based synchronisation protocols WA-RBS and WA-OBS are discussed based on abortions of transactions issuing illegal write operations. In the evaluation, the number of transactions aborted can be more reduced in the WA protocols than the RA protocols.

Read-abortion (RA) based synchronization protocols to prevent illegal information flow

In information systems, data in an object may illegally flow into another object through manipulations of the objects. First, we define a legal information flow relation ri⇒rj among roles ri and rj. It means, if a subject granted the role ri manipulates objects before another subject granted the role rj, no illegal information flow occur. We discuss safe systems where no illegal information flow occur even if operations from different subjects are performed in any order. Then, we discuss a read-abortion role-based synchronization (RA-RBS) protocol and a read-abortion object-based synchronization (RA-OBS) protocol to prevent illegal information flow in unsafe systems. Here, a transaction is aborted if the transaction reads an object and illegal information flow might occur. We evaluate the RA-RBS and RA-OBS protocols in terms of number of transactions aborted.

Multilevel secure data stream processing: Architecture and implementation

The proliferation of sensors and mobile devices and their connectedness to the network have given rise to numerous types of situation monitoring applications. Data Stream Management Systems DSMSs have been proposed to address the data processing needs of such applications that require collection of high-speed data, computing results on-the-fly, and taking actions in real-time. Although a lot of work appears in the area of DSMS, not much has been done in multilevel secure MLS DSMS making the technology unsuitable for highly sensitive applications, such as battlefield monitoring. An MLS--DSMS should ensure the absence of illegal information flow in a DSMS and more importantly provide the performance needed to handle continuous queries. We illustrate why the traditional DSMSs cannot be used for processing multilevel secure continuous queries and discuss various DSMS architectures for processing such queries. We implement one such architecture and demonstrate how it processes continuous queries. In order to provide better quality of service and memory usage in a DSMS, we show how continuous queries submitted by various users can be shared. We provide experimental evaluations to demonstrate the performance benefits achieved through query sharing.

Purpose-Based Information Flow Control for Cyber Engineering

Cyber engineering is getting more significant in not only manufacturing but also business applications. Information management technologies play a key role in cyber engineering. In order to realize the cyber engineering, objects in information systems are required to be not only secure but also consistent in the presence of security threats and multiple conflicting transactions. There are so far many discussions on each of the security management and concurrence control. However, there is no discussion on synchronization mechanisms to realize both of them. In this paper, we discuss a novel synchronization protocol to make an information system not only secure but also consistent. In the role-based access control model, authorized access requests are specified in roles which are collections of access rights. A transaction issued by a subject is assigned with a subfamily of the roles granted to the subjects, which are named purpose. We first define legal information flow relations among purposes. Based on the legal information flow relations, we discuss a purpose-marking (PM) protocol to prevent illegal information flow to occur by performing conflicting transactions in a serializable way. We evaluate the PM protocol in terms of the number of transactions to be aborted.

A purpose-based synchronisation protocol of multiple transactions in multi-agent systems

Multiple agents cooperate with each other through manipulating objects. A transaction is a unit of work issued by an agent. A transaction is assigned with a purpose which is a subfamily of roles granted to the agent. Even if transactions issue methods according to the purposes, illegal information flow might occur. We define legal, independent, illegal, and possibly illegal information flow relations among purposes. We discussed the purpose-based marking protocol to prevent illegal information flow. Then, we discussed the releasing mechanism of purpose marks to improve the throughput. Finally, we evaluated the Purpose-based Marking and Releasing (PMR) protocol.

A legal information flow (LIF) scheduler based on role-based access control model

Information systems have to be consistent and secure in presence of multiple conflicting transactions. The role-based access control (RBAC) model is widely used to keep information systems consistent and secure. A role shows a job function in an enterprise and is a set of access rights (permissions). Here, a subject s is allowed to issue a method op to an object o only if an access right 〈 o, op〉 is included in the roles granted to the subject s. A subject is granted one or more than one role and issues a transaction to multiple objects. The transaction is assigned with some roles of the subject which is referred to as purpose. Even if every access request issued by every subject is authorized in the roles, illegal information flow might occur as well known confinement problem. In this paper, we define a legal information flow (LIF) relation ( R 1 ⪯ I R 2) among a pair of role families R 1 and R 2 to prevent illegal information flow. Here, an LIF relation R 1 ⪯ I R 2 shows that no illegal information flow occur if a transaction T 1 with a role family R 1 is performed prior to another transaction T 2 with a role family R 2. In addition, it is significant to discuss which transaction to be performed prior to another transaction if the both transactions manipulate the same object in a conflicting way. In this paper, we define a significantly precedent relation R 1 ⪯ s R 2 among role families R 1 and R 2 which implies that the role family R 2 is more significant than R 1. Suppose a pair of transactions T 1 and T 2 with role families R 1 and R 2 issue conflicting methods op 1 and op 2, respectively, to an object o. If R 1 ⪯ s R 2, op 2 is performed on the object o prior to op 1. The more significant a transaction is, the more prior it is performed. We discuss a legal information flow (LIF) scheduler to synchronize transactions so as to prevent illegal information flow and to serialize conflicting methods from multiple transactions in terms of significancy and information flow relation of roles families. We evaluate the LIF scheduler in terms of how much illegal information flow can be prevented compared with the other scheduler.

LOCKING PROTOCOL FOR INFORMATION FLOW CONTROL

We discuss a novel role locking protocol (RLP) to prevent illegal information flow among objects in a role-based access control (RBAC) model. In this paper, we define a conflicting relation among roles "a role R1 conflicts with another role R2" to show that illegal information flow may occur if a transaction associated with role R1 is performed before another transaction with role R2. Here, we introduce a role lock on an object to abort a transaction with role R1 if another transaction with role R2 had been already performed on the object. Role locks are not released even if transactions issuing the role locks commit. After data in an object o1 flow to another object o2, if the object o1 is updated, the data in the object o2 is independent of the object o1, i.e. obsolete. A role lock on an object can be released if information brought into the object is obsolete. We discuss how to release obsolete role locks. We also discuss how to implement the role locking protocol in single-server and multi-server systems.

Checking secure information flow in Java bytecode by code transformation and standard bytecode verification

AbstractA method is presented for checking secure information flow in Java bytecode, assuming a multilevel security policy that assigns security levels to the objects. The method exploits the type‐level abstract interpretation of standard bytecode verification to detect illegal information flows. We define an algorithm transforming the original code into another code in such a way that a typing error detected by the Verifier on the transformed code corresponds to a possible illicit information flow in the original code. We present a prototype tool that implements the method and we show an example of application. Copyright © 2004 John Wiley & Sons, Ltd.

Secure object deletion and garbage collection in multilevel object bases1

This paper introduces guidelines aiming at the prevention of illegal information flows due to object deletion in multilevel secure object database management systems (ODBMSs). Although a delete operation can be viewed as a kind of write operation, this does not suffice to avoid covert channels. Hence, the attention is focused on delete operation and its implications on database security. The guidelines we propose are formally stated as security principles. We also show how to design a garbage collection mechanism in a multilevel secure ODBMS. The garbage collection mechanism ensures both security and referential integrity.