Exception-based information flow control in object-oriented systems

We present an approach to control information flow in object-oriented systems. The decision of whether an information flow is permitted or denied depends on both the authorizations specified on the objects and the process by which information is obtained and transmitted. Depending on the specific computations, a process accessing sensitive information could still be allowed to release information to users who are not allowed to directly access it. Exceptions to the permissions and restrictions stated by the authorizations are specified by means of exceptions associated with methods. Two kinds of exceptions are considered: invoke exceptions, applicable during a mehtod execution and reply exceptions applicable to the information returned by a method. Information flowing from one object into another or returned to the user is subject to the different exceptions specified for the methods enforcing the transmission. We formally characterize information transmission and flow in a transaction and define the conditions for safe information flow. We define security specifications and characterize safe information flows. We propose an approach to control unsafe flows and present an algorithm to enforce it. We also illustrate an efficient implementation of our controls and present some experimental results evaluating its performance.

[1]  Elisa Bertino,et al.  Information Flow Control in Object-Oriented Systems , 1997, IEEE Trans. Knowl. Data Eng..

[2]  Dorothy E. Denning,et al.  Cryptography and Data Security , 1982 .

[3]  David J. DeWitt,et al.  The 007 Benchmark , 1993, SIGMOD '93.

[4]  Yung-Ying Liu,et al.  Privacy and Security in Computer Systems. , 1974 .

[5]  LouAnna Notargiacomo,et al.  Beyond the pale of MAC and DAC-defining new forms of access control , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[6]  Silvana Castano,et al.  Database Security , 1997, IFIP Advances in Information and Communication Technology.

[7]  Alley Stoughton.  Access Flow: A Protection Model which Integrates Access Control and Information Flow , 1981, 1981 IEEE Symposium on Security and Privacy.

[8]  D. Elliott Bell,et al.  Secure Computer System: Unified Exposition and Multics Interpretation , 1976 .

[9]  A. L. Wilkinson,et al.  A penetration analysis of a Burroughs Large System , 1981, OPSR.

[10]  Helena Winkler.  Sybase Secure SQL Server , 1992 .

[11]  Richard A. Kemmerer.  A Practical Approach to Identifying Storage and Timing Channels , 1982, 1982 IEEE Symposium on Security and Privacy.

[12]  Dorothy E. Denning,et al.  A lattice model of secure information flow , 1976, CACM.

[13]  Sushil Jajodia,et al.  Integrating an object-oriented data model with multilevel security , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[14]  K. G. Walter,et al.  Primitive Models for Computer Security , 1974 .

[15]  Paul A. Karger,et al.  Limiting the Damage Potential of Discretionary Trojan Horses , 1987, 1987 IEEE Symposium on Security and Privacy.

[16]  Gregory R. Andrews,et al.  An Axiomatic Approach to Information Flow in Programs , 1980, TOPL.