Information Flow Control Model Research Articles

DIFCS: A Secure Cloud Data Sharing Approach Based on Decentralized Information Flow Control

Summary In the field of cloud computing, collaboration and data sharing among clouds have dramatically increased. How to protect the security of shared cloud data is being an urgent problem. Based on decentralized information flow control (DIFC) model, this paper presents an approach, DIFC-based data sharing approach (DIFCS), to protect both confidentiality and integrity of shared cloud data. Additionally, this paper designs a privilege protection policy for DIFCS, resulting in its capability of preventing malicious users from modifying privilege. The correctness and security properties of DIFCS are proved by formal analysis and verification, where firstly, DIFCS is formally interpreted into high-level petri net (HLPN) representation and analyzed using Z language, then is automatically verified with SMT-Lib and Z3 solver. The formal analysis and verification results reveal that DIFCS holds the security properties of confidentiality, integrity, authenticity, and privilege tamper-proof. The experimental results further demonstrate the high efficiency of DIFCS.

Tenant-Led Ciphertext Information Flow Control for Cloud Virtual Machines

When users upload their private data to the cloud, they lose control of the data stored in the cloud server. If the cloud system cannot provide an effective security mechanism to protect the data, the consequent data leakage issue will hinder the development of cloud computing. Conventional access control and encryption technologies cannot effectively control the propagation of tenant private data in the system. The mandatory one-way information flow control model is limited by the complexity of the cloud environment, and it is difficult to effectively protect private data stored in the cloud. To solve the above problems, this article proposes a tenant-led ciphertext information flow control method for cloud virtual machines. Through the design of a decentralized information flow control security policy, a secret-domain key management scheme, and a multi-ID-based threshold encryption scheme, the information flow control strategies of taint infection, secret-level reduction, and ability propagation are realized in a ciphertext form, which can effectively prevent malicious users inside and outside the system from illegally reading private data. The feasibility of this method is verified by a security proof and an experiment.

CDroid: practically implementation a formal-analyzed CIFC model on Android

Decentralized information flow control (DIFC) operating systems provide mechanisms for applications to handle the secrecy and integrity of their data by themselves. DIFC adapts to the distributed systems well, but not for the centralized authorization systems where an administrator manages all the privileges. For example, Android is full of untrusted third-party applications. A phone user may want to specify what kind of application can deal with what kind of private data by enforcing information flow control. To address this, we proposed a novel formal-described and security-proofed centralized information flow control (CIFC) model. In CIFC, taint tag of private data and capability label of applications are designed to support fine-grained and user-defined information flow control. Differs from DIFC and classic information flow control models, CIFC model controls information flow according to the relation between tag and label rather than the relation between two labels of applications. We use Value-passing Security Process Algebra (VSPA) to clarify the formal semantics of CIFC model. The verification of system equivalence proves that the model guarantees the noninterference security property in virtue of Checker of Persistent Security (CoPS) tool. We also implemented CDroid, a prototype of the CIFC model which can track and control information flow at runtime. CDroid is demonstrated to be an accurate system to achieve the security goal through several function test experiments. Furthermore, CDroid has 5% lead in memory consumption and 17% overhead of runtime performance compared to Android.

An information flow control model in a topic-based publish/subscribe system

An information flow control model in a topic-based publish/subscribe system

Mechanisms of neuroprogression and interventions to predict and arrest it

Decentralized information flow control (DIFC) operating systems provide mechanisms for applications to handle the secrecy and integrity of their data by themselves. DIFC adapts to the distributed systems well, but not for the centralized authorization systems where an administrator manages all the privileges. For example, Android is full of untrusted third-party applications. A phone user may want to specify what kind of application can deal with what kind of private data by enforcing information flow control. To address this, we proposed a novel formal-described and security-proofed centralized information flow control (CIFC) model. In CIFC, taint tag of private data and capability label of applications are designed to support fine-grained and user-defined information flow control. Differs from DIFC and classic information flow control models, CIFC model controls information flow according to the relation between tag and label rather than the relation between two labels of applications. We use Value-passing Security Process Algebra (VSPA) to clarify the formal semantics of CIFC model. The verification of system equivalence proves that the model guarantees the noninterference security property in virtue of Checker of Persistent Security (CoPS) tool. We also implemented CDroid, a prototype of the CIFC model which can track and control information flow at runtime. CDroid is demonstrated to be an accurate system to achieve the security goal through several function test experiments. Furthermore, CDroid has 5% lead in memory consumption and 17% overhead of runtime performance compared to Android.

Fine-grained Privilege Propagation in DIFC Model

In Decentralized Information Flow Control Model, Label is used for marking security level of sensitive data (such as static file, memory data or network packet). Anyone who wants to access the labeled data must obtain relative label first, so authorization is a process that the data owner give data receiver the capability to get the label. Traditionally, most researchers focus on the DIFC model innovation and application, few pay attention to how to disseminate the privilege of adding tag or removing tag. Fine-grained privilege propagation is the foundation for sharing sensitive data securely. In this paper we propose the model of fine-grained privilege propagation. The model provides label privilege granting and revocation in process level and describes four level of authorization for more flexible privilege propagation. The experiments demonstrate that FPPM improves the flexibility of data sharing.

Controlling Information Flows During Software Development

Information flow control (IFC) is useful in preventing information leakage during software execution. Our survey reveals that no IFC model is applied on the entire software development process. Applying an IFC model on the entire software development process offers the following features: (1) viewpoints of all stakeholders (i.e., customers and analysts) can be included and (2) the IFC model helps correcting statements that may leak information during every development phase. In addition that no IFC model is applied to the entire software development process, we failed to identify an IFC model that can reduce runtime overhead. According to the above description, we designed a new IFC model named PrcIFC (process IFC). PrcIFC is applied on the entire software development process. Moreover, PrcIFC is disabled after software testing to reduce runtime overhead.

Access Control and Information Flow Control for Web Services Security

With the advancement of web services technology, security has become an increasingly important issue. Various security standards have been developed to secure web services at the transport and message level, but application level has received less attention. The security solutions at the application level focus on access control which cannot alone ensure the confidentiality and integrity of information. The solution proposed in this paper consists on a hybrid model that combines access control (AC) and information flow control (IFC). The AC mechanism uses the concept of roles and attributes to control user access to web services' methods. The IFC mechanism uses labels to control how the roles access to the system's objects and verify the information flows between them to ensure the information confidentiality and integrity. This manuscript describes the model, gives the demonstration of the IFC model safety, presents the modeling and implementation of the model and a case study.

Controlling Information Flows in Net Services with Low Runtime Overhead

This paper presents the information flow control model NetIFC to prevent information leakage when a net service is being executed. NetIFC offers the following features: (1) it blocks at least statements as possible and (2) it reduces runtime overhead. To achieve the first feature, NetIFC strictly controls output statements because only output may leak information. To achieve the second feature, NetIFC is executed in parallel with a service in different sites to monitor the service. This monitoring style substantially reduce runtime overhead when comparing with embedding a model in a net service.

Information Flow Control for Secure Cloud Computing

Security concerns are widely seen as an obstacle to the adoption of cloud computing solutions. Information Flow Control (IFC) is a well understood Mandatory Access Control methodology. The earliest IFC models targeted security in a centralised environment, but decentralised forms of IFC have been designed and implemented, often within academic research projects. As a result, there is potential for decentralised IFC to achieve better cloud security than is available today. In this paper we describe the properties of cloud computing—Platform-as-a-Service clouds in particular—and review a range of IFC models and implementations to identify opportunities for using IFC within a cloud computing context. Since IFC security is linked to the data that it protects, both tenants and providers of cloud services can agree on security policy, in a manner that does not require them to understand and rely on the particulars of the cloud software stack in order to effect enforcement.

Managing the Intertwining Among Users, Roles, Permissions, and User Relationships in an Information Flow Control Model

Information flow control prevents information leakage during the execution of an application. Many information flow control models are available and they offer useful features. In the past years, we identified that managing the intertwining among users, roles, permissions, and user relationships is essential. Since we cannot identify a model that manages the intertwining, we developed a new model to offer the feature. This paper gives definitions to the intertwining and proposes the model.

A Partial Ordered Number System for Information Flow Control

Information flow control models can be applied widely. This paper discusses only the models preventing information leakage during program execution. In the prevention, an information flow control model dynamically monitors statements that will cause information flows and ban statements that may cause leakage. We involved in the research of information flow control for years and identified that sensitive information may be leaked only when it is output. However, most existing models ignore information flows induced by output statements. We thus designed a new model XIFC (X information flow control) that especially emphasizes the monitoring of output statements. We also designed XIFC as a precise and low runtime overhead model. To achieve this purpose, we took a different viewpoint to re-examine the features offered by existing models and extracted a necessary feature set for the design. Our experiments show that XIFC bans every non-secure information flow and substantially reduces runtime overhead when comparing with our previous work.

An information flow control model for software processes that manages developer associations

A software process (software development process) should be followed to develop software. As agreed, process‐centered software engineering environments (PSEEs) facilitate controlling complicated software processes. Quite a few issues regarding PSEE such as process evolution support have been addressed. Nevertheless, PSEE researchers have generally ignored the important issues of ensuring secure product access during process execution. This can be achieved through information flow control. This paper proposes an information flow control model to ensure secure product access. The model also manages developer associations and adapts to developer association change.

A label‐based information flow control model for object‐oriented systems

This paper proposes a label‐based information flow control model to prevent information leakage within object‐oriented systems. It offers the features of: (a) adapting to dynamic object state change, (b) adapting to dynamic role change, (c) preventing indirect information leakage, (d) detailing the control granularity to variables, (e) allowing purpose‐oriented method invocation, (f) controlling method invocation through argument sensitivity, (g) allowing declassification, and (h) allowing only trusted sources to write a variable.

Information flow control in multithread applications based on access control lists

Information flow control models prevent information leakage during the execution of an application. We developed a model OORBAC to control information flows in object-oriented systems. Soon after the development of OORBAC, we identified that the model cannot solve the problems induced by multithreaded applications. We thus adapted the concepts of OORBAC to develop a new information flow control model. It offers the features of OORBAC and solves the problems induced by multithread object-oriented applications. The new model is named MtACL (information flow control model for multithreaded object-oriented applications based on access control lists). The multithreaded problems solved by MtACL include the shared memory problem, the non-interference problem, and the combination leakage problem. This paper presents MtACL and proves that the model solves the multithreaded problems.

Managing role relationships in an information flow control model

An information flow control model prevents information leakage during the execution of an application. Quite a few information flow control models have been developed. We also developed information flow control models based on role-based access control (RBAC). Our research revealed that user relationships might result in role relationships when users play roles in an application. Moreover, role relationships may cause role permission change. We also identified that role relationship change may invalidate the results of previous join operations (which prevent indirect information leakage). According to our survey, we cannot identify a model that manages role relationships well. Moreover, we cannot identify a model that corrects the invalidated join results. This paper presents an information flow control model that manages role relationships and corrects the invalidated join results. It is an extension of our previous work OORBAC (object-oriented RBAC). The model is named EOORBAC (extended OORBAC). We evaluate EOORBAC against OORBAC. The evaluation result is also shown in this paper.

An information flow control model for C applications based on access control lists

Access control within an application during its execution prevents information leakage. The prevention can be achieved through information flow control. Many information flow control models were developed, which may be based on discretionary access control (DAC), mandatory access control (MAC), label-based approach, and role-based access control (RBAC). Most existing models are for object-oriented systems. Since the procedural C language is still in use heavily, offering a model to control information flows for C applications should be fruitful. Although we identified information flow control models that can be applied to procedural languages, they do not offer the features we need. We thus developed a model to control information flows for C applications. Our model is based on access control lists (ACLs) and named CACL. It offers the following features: (a) controlling both read and write access, (b) preventing indirect information leakage, (c) detailing the control granularity to variables, (d) avoiding improper function call, (e) controlling function call through argument sensitivity, and (f) preventing change of an application when the access rights of the application’s real world users change. This paper presents CACL.

Dynamic adaptation to object state change in an information flow control model

Dynamic adaptation to object state change is necessary for an information flow control model because object state may change in an unpredictable manner during runtime. To accomplish the adaptation, an information flow control model should offer the following features: (a) access rights can be dynamically changed according to object state change, (b) purpose-oriented method invocation can be achieved, and (c) information flows among variables can be controlled. According to our survey, no existing model offers the adaptation well. This paper proposes a solution to the adaptation, which is offered by the information flow control model object-oriented role-based access control.

ASSOCIATION-BASED INFORMATION FLOW CONTROL IN OBJECT-ORIENTED SYSTEMS

Controlling information flows to prevent information leakage within an application is essential. According to the maturity of object-oriented techniques, many models were developed for the control in object-oriented systems. Since objects may be dynamically instantiated during program execution, controlling information flows among objects is difficult. Our research revealed that association is useful in the control. We developed an association-based information flow control model for object-oriented systems. It precisely controls information flows among objects through associations and constraints. It also offers features such as controlling method invocation through argument sensitivity, allowing declassification, allowing purpose-oriented method invocation, and precisely controlling write access. This paper proposes the model and the implementation of the model, which is composed of the language AbFlow (association-based flow) and its supporting environment.

An agent-based inter-application information flow control model

Access control in an application prevents information leakage in the application. The prevention can be achieved by controlling information flows. Many information flow control models have been developed. Since applications may cooperate, controlling information flows among cooperating applications is necessary. Our survey reveals that no existing model offers the control. We thus developed a model to control information flows among cooperating object-oriented applications. In designing the model, we require that cooperating applications communicate with one another through JAVA RMI (remote method invocation). Our model is based on the following considerations: when a RMI occurs, the security level of an argument should not be higher than that of the parameter receiving the argument's value, and the security level of a variable receiving a method return value should not be lower than that of the method return value. The model is agent-based. Moreover, different applications can embed different information flow control models. With this, the proposed model coordinates heterogeneous information flow control models. This paper presents our inter-application information flow control model.