Information flow control for standard OS abstractions

By Maxwell N. Krohn, A. Yip, Micah Z. Brodsky, Natan Cliffer, Eddie Kohler, R. Morris. Symposium on Operating Systems Principles, 2007

524 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/2d85a5a0e7d25ad212dda1d1d4969cf4c11da291

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, background): “System call sequences for intrusion and anomaly detection [59], [60], [61], [62], [63], [64], [65] are an especially popular alternative for rootkit analysis since hooked IAT or SSDT entries often make repetitive patterns of system calls.”
Automatic creation of SQL Injection and cross-site scripting attacks (2009, background): “Information-flow control restricts the flow of information between pieces of software, either statically [26] or dynamically [17, 32].”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (unknown): “However, most DIFC systems require that all trusted code is deployed in a centralized platform or administrative domain under a trusted, privileged reference monitor [18, 45, 52, 60, 69, 76]; similar enforcements have also been realized in a browser (COWL [66]) and a mobile device (Maxoid [72]).”
Merlin: specification inference for explicit information flow problems (2009, background): “The growing importance of explicit information flow is evidences by the abundance of analysis tools for information flow tracking and violation detection at the level of the language, runtime, operating system, and hardware [2, 3, 7, 9–12, 16, 18, 19, 22, 27, 29, 33, 36].”
Permission Re-Delegation: Attacks and Defenses (2011, background): “Decentralized information ﬂow control (DIFC) lets applications explicitly express their information ﬂow policies to the operating system or a language runtime, which then enforces the policies [30, 26, 39, 11].”
FlowFence: Practical Data Protection for Emerging IoT Application Frameworks (2016, methodology): “For example, Flume [42] enforces flow control at the level of processes while retaining existing OS abstractions, Hails [28] presents a web framework that uses MAC to confine untrusted web apps, and COWL [63] introduces labeled compartments for JavaScript code in web apps.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “While most above works centralize IFC, decentralized IFC (DIFC) techniques [59, 17, 28] emphasize the ability of principals to define and create new labels.”
Airavat: Security and Privacy for MapReduce (2010, methodology): “As in Flume [25], when a client creates a labeled file, she first creates an empty file with the same labels, taint s herself with the label to acquire private data, and then writ es it to the newly created file in HDFS.”
CQSTR: Securing Cross-Tenant Applications with Cloud Containers (2016, background): “How to extend across multiple cloud platforms remains an open question.”
Preliminary design of the SAFE platform (2011, unknown): “, [10, 4]), which are coarse-grained and dynamic.”
Protecting Visual Information in Augmented Reality from Malicious Application Developers (2019, background): “introduced the Flume system to allow safe interaction between conventional and DIFC-aware (Decentralized Information Flow Control) processes [14].”