JFlow: Practical Mostly-Static Information Flow Control

13 years 8 months ago

Download www.cs.cornell.edu

A promising technique for protecting privacy and integrity of sensitive data is to statically check information ﬂow within programs that manipulate the data. While previous work has proposed programming language extensions to allow this static checking, the resulting languages are too restrictive for practical use and have not been implemented. In this paper, we describe the new language JFlow, an extension to the Java language that adds statically-checked information ﬂow annotations. JFlow provides several new features that make information ﬂow checking more ﬂexible and convenient than in previous models: a decentralized label model, label polymorphism, run-time label checking, and automatic label inference. JFlow also supports many language features that have never been integrated successfully with static information ﬂow control, including objects, subclassing, dynamic type tests, access control, and exceptions. This paper deﬁnes the JFlow language and presents formal ru...

Andrew C. Myers

Real-time Traffic