Making information flow explicit in HiStar

By Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, David Mazières. USENIX Symposium on Operating Systems Design and Implementation, 2006

656 citations recorded by the source corpus.

HiStar is a new operating system designed to minimize the amount of code that must be trusted. HiStar provides strict information flow control, which allows users to specify precise data security policies without unduly limiting the structure of applications. HiStar's security features make it possible to implement a Unix-like environment with acceptable performance almost entirely in an untrusted user-level library. The system has no notion of superuser and no fully trusted code other than the kernel. HiStar's features permit several novel applications, including an entirely untrusted login process, separation of data between virtual private networks, and privacy-preserving, untrusted virus scanners.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f7ebf78763ba219807bd57f9e574cd15608540ac

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

CQSTR: Securing Cross-Tenant Applications with Cloud Containers (2016, background): “How to extend across multiple cloud platforms remains an open question.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “While most above works centralize IFC, decentralized IFC (DIFC) techniques [59, 17, 28] emphasize the ability of principals to define and create new labels.”
Merlin: specification inference for explicit information flow problems (2009, background): “The growing importance of explicit information flow is evidences by the abundance of analysis tools for information flow tracking and violation detection at the level of the language, runtime, operating system, and hardware [2, 3, 7, 9–12, 16, 18, 19, 22, 27, 29, 33, 36].”
KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs (2008, positive): “To demonstrate the applicability of our system to other forms of system code we applied KLEE to testing a usermode version of the HiStar [29] operating system kernel.”
Comprehensive formal verification of an OS microkernel (2014, background): “Making information .ow explicit in HiStar.”
Systematic Detection of Capability Leaks in Stock Android Smartphones (2012, methodology): “Also, system-level approaches such as Asbestos [36], HiStar [39], Process Coloring [25], and PRECIP [37] instantiate information ﬂow at the process level by labeling running processes and propagating those labels based on process behavior.”
Airavat: Security and Privacy for MapReduce (2010, methodology): “While decentralized information flow control (DIFC) [45, 49, 51] would provide far greater flexibility for access control policies within Airavat, only prototype DIFC operating systems exist.”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (neutral): “Many well-regarded secure system designs factor out side/covert channels based on hardware limitations or execution time, at least to some degree [21, 52, 60, 69, 76], because doing so enables progress in designing and building secure systems.”
Corey: An Operating System for Many Cores (2008, neutral): “The interface between devices and library operating systems is similar to Xen’s asynchronous I/O rings [4] and HiStar’s network device interface [26].”
Analyzing inter-application communication in Android (2011, background): “, which applications communicate and how they communicate) to the OS or a language runtime, which then enforces the policies [19, 23, 28, 10].”
Permission Re-Delegation: Attacks and Defenses (2011, background): “Decentralized information flow control (DIFC) lets applications explicitly express their information flow policies to the operating system or a language runtime, which then enforces the policies [30, 26, 39, 11].”
CHEX: statically vetting Android apps for component hijacking vulnerabilities (2012, background): “Security mechanism based on information flows, such as JIF [29], HiStar [34] and Asbestos [13], are also related in that our work define and detect component hijacking by means of data-flow policies, despite that we do not enforce the policies in runtime.”
FlowVisor: A Network Virtualization Layer (2009, background): “Above, the ability to build on a consistent hardware abstraction has allowed operating systems to flourish (e.g., UNIX, MacOS, several flavors of Linux, and Windows) and even encouraged entirely new approaches [24] [28].”
FlowFence: Practical Data Protection for Emerging IoT Application Frameworks (2016, background): “FlowFence builds on substantial prior work on information flow control that use labeling architectures [52, 42, 18, 71, 63, 28, 62, 41, 15, 38, 46].”
Labels and event processes in the asbestos operating system (2005, methodology): “Our file system semantics resemble those of HiStar [Zeldovich et al. 2006] except for the way privilege is stored.”