Sciweavers

Share
ESORICS
2012
Springer

Boosting the Permissiveness of Dynamic Information-Flow Tracking by Testing

7 years 8 months ago
Boosting the Permissiveness of Dynamic Information-Flow Tracking by Testing
Tracking information flow in dynamic languages remains an open challenge. It might seem natural to address the challenge by runtime monitoring. However, there are well-known fundamental limits of dynamic flow-sensitive tracking of information flow, where paths not taken in a given execution contribute to information leaks. This paper shows how to overcome the permissiveness limit for dynamic analysis by a novel use of testing. We start with a program supervised by an informationflow monitor. The security of the execution is guaranteed by the monitor. Testing boosts the permissiveness of the monitor by discovering paths where the monitor raises security exceptions. Upon discovering a security error, the program is modified by injecting an annotation that prevents the same security exception on the next run of the program. The elegance of the approach is that it is sound no matter how much coverage is provided by the testing. Further, we show that when the mechanism has discovered t...
Arnar Birgisson, Daniel Hedin, Andrei Sabelfeld
Added 29 Sep 2012
Updated 29 Sep 2012
Type Journal
Year 2012
Where ESORICS
Authors Arnar Birgisson, Daniel Hedin, Andrei Sabelfeld
Comments (0)
books