Language-based information-flow security

By Andrei Sabelfeld, A. Myers. IEEE J. Sel. Areas Commun., 2003

2,222 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/cc076dcd0bbed4e019ea040a8cf0451d8717c476

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Aegis: A Single-Chip Secure Processor (2007, background): “Previous efforts in this area such as JFlow [87, 115] address this problem.”
Hyperproperties (2010, background): “In language-based information-flow security [53], a program P is sometimes modeled (e.”
Dimensions and principles of declassification (2005, methodology): “This view follows the data protection view of noninterference, as it is often used in language based security [Coh78, VSI96, SM03 ].”
On the Foundations of Quantitative Information Flow (2009, background): “– In secure information flow analysis [1] the question is whether a program could leak information about its high (i.”
TaintDroid (2010, methodology): “We evaluated the accuracy of TaintDroid using 30 randomly selected, popular Android applications that use location, camera, or microphone data.”
Proving differential privacy with shadow execution (2019, methodology): “To capture the potential divergence of shadow execution, each typing rule is associated with a program counterpc with two possible values ⊥ and ⊤ (introducing program counters in a type system is common in information flow control to track implicit flows [37]).”
Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis (2007, methodology): “To this end, the system analyzes web server logs and automatically retrieves the profiles (length and structure) of typical parameters of any protected web application.”
Airavat: Security and Privacy for MapReduce (2010, background): “DIFC systems are intended to eliminate information leaks via storage channels, but cannot eliminate timing channels [28] or probabilistic channels [ 43 ].”
Analyzing Memory Accesses in x86 Executables (2004, neutral): “Static analysis provides techniques that can help with such problems [30, 29].”
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks (2006, background): “taint analysis) has played a central role in computer security for over three decades [1, 10, 8, 30, 25].”
EnerJ: approximate data types for safe and general low-power computation (2011, background): “More fundamentally, current trends point toward a utilization wall, in which the amount of active die area is limited by how much power can be fed to a chip.”
Separating agreement from execution for byzantine fault tolerant services (2003, background): “Observe that availability is also necessary for preserving confidentiality, because a strategically placed rejected request could be used to communicate confidential information by introducing a termination channel [ 42 ].”
Noninterference via Symbolic Execution (2012, background): “The policy has been substantially studied in the language-based security community [16] and typically relies on information flow type systems [15, 21, 22]; however, these are criticized for being conservative and rejecting many secure programs.”
Declassification: Dimensions and principles (2009, neutral): “This view follows the data protection view of nonin-terference, as it is often used in language-based security [16,67,77].”
CacheAudit: A Tool for the Static Analysis of Cache Side Channels (2013, background): “I = Ihi× Ilo, where only the high component is meant to be kept secret and the low component may be provided by the adversary, a common setting in information-flow analysis [42].”
Practical Specification of Belief Manipulation in Games (2021, background): “…applications, such as teamwork in networks without central coordination (Roth, Simmons, and Veloso 2005), consensus in distributed systems (Olfati-Saber, Fax, and Murray 2007), and security of information ﬂow in programs (Sabelfeld and Myers 2003) or between agents (Van Eijck and Gattinger 2015).”
Automatic creation of SQL Injection and cross-site scripting attacks (2009, background): “Information-flow control restricts the flow of information between pieces of software, either statically [26] or dynamically [17, 32].”