Loading...
Please wait, while we are loading the content...
Similar Documents
Information flow control for standard OS abstractions (2007)
| Content Provider | CiteSeerX |
|---|---|
| Author | Cliffer, Natan Yip, Alexander Krohn, Maxwell Eddie, Kaashoek Morris, Kohler Robert Frans, M. Brodsky, Micah |
| Abstract | Decentralized Information Flow Control (DIFC) [24] is an approach to security that allows application writers to control how data flows between the pieces of an application and the outside world. As applied to privacy, DIFC allows untrusted software to compute with private data while trusted security code controls the release of that data. As applied to integrity, DIFC allows trusted code to protect untrusted software from unexpected malicious inputs. In either case, only bugs in the trusted code, which tends to be small and isolated, can lead to security violations. We present Flume, a new DIFC model and system that applies at the granularity of operating system processes and standard OS abstractions (e.g., pipes and file descriptors). Flume eases DIFC’s use in existing applications and allows safe interaction between conventional and DIFC-aware processes. Flume runs as a user-level reference monitor on Linux. A process confined by Flume cannot perform most system calls directly; instead, an interposition layer replaces system calls with IPC to the reference monitor, which enforces data flow policies and performs safe operations on the process’s behalf. We ported a complex Web application (MoinMoin wiki) to Flume, changing only 2 % of the original code. The Flume version is roughly 30–40 % slower due to overheads in our current implementation but supports additional security policies impossible without DIFC. Categories and Subject Descriptors: |
| File Format | |
| Publisher Date | 2007-01-01 |
| Access Restriction | Open |
| Subject Keyword | Difc-aware Process Flume Cannot Security Violation User-level Reference Monitor Standard O Abstraction Reference Monitor Application Writer Unexpected Malicious Input Information Flow Control Complex Web Application Flume Version Additional Security Policy Untrusted Software Present Flume Process Behalf Trusted Code New Difc Model Difc Use Performs Safe Operation Trusted Security Code File Descriptor Safe Interaction Data Flow Policy Original Code Interposition Layer Replaces System |
| Content Type | Text |
