Sökning: onr:"swepub:oai:research.chalmers.se:825c0c83-3540-4daa-bc6c-bafa0388cdc1" >
Information-flow co...
Information-flow control for database-backed applications
-
- Guarnieri, Marco (författare)
- IMDEA Software Institute
-
- Balliu, Musard, 1985 (författare)
- KTH,Teoretisk datalogi, TCS,Kungliga Tekniska Högskolan (KTH),Royal Institute of Technology (KTH)
-
- Schoepe, Daniel, 1989 (författare)
- Chalmers tekniska högskola,Chalmers University of Technology
-
visa fler...
-
- Basin, David (författare)
- Eidgenössische Technische Hochschule Zürich (ETH),Swiss Federal Institute of Technology in Zürich (ETH),ETH Zurich
-
- Sabelfeld, Andrei, 1974 (författare)
- Chalmers tekniska högskola,Chalmers University of Technology
-
visa färre...
-
(creator_code:org_t)
- Institute of Electrical and Electronics Engineers (IEEE), 2019
- 2019
- Engelska.
-
Ingår i: Proceedings - 4th IEEE European Symposium on Security and Privacy, EURO S and P 2019. - : Institute of Electrical and Electronics Engineers (IEEE). ; June 2019, s. 79-94
- Relaterad länk:
-
https://kth.diva-por... (primary) (Raw object)
-
visa fler...
-
https://doi.org/10.1...
-
https://research.cha...
-
https://urn.kb.se/re...
-
visa färre...
Abstract
Ämnesord
Stäng
- Securing database-backed applications requires tracking information across the application program and the database together, since securing each component in isolation may still result in an overall insecure system. Current research extends language-based techniques with models capturing the database's behavior. This research, however, relies on simplistic database models, which ignore security-relevant features that may leak sensitive information. We propose a novel security monitor for database-backed applications. Our monitor tracks fine-grained dependencies between variables and database tuples by leveraging database theory concepts like disclosure lattices and query determinacy. It also accounts for a realistic database model that supports security-critical constructs like triggers and dynamic policies. The monitor automatically synthesizes program-level code that replicates the behavior of database features like triggers, thereby tracking information flows inside the database. We also introduce symbolic tuples, an efficient approximation of dependency-tracking over disclosure lattices. We implement our monitor for Scala programs and demonstrate its effectiveness on four case studies.
Ämnesord
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Inbäddad systemteknik (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Embedded Systems (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Annan elektroteknik och elektronik (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Other Electrical Engineering, Electronic Engineering, Information Engineering (hsv//eng)
Nyckelord
- Information flow control
- Disclosure lattices
- Database backed applications
- Computer Science
Publikations- och innehållstyp
- kon (ämneskategori)
- ref (ämneskategori)