Stack-based access control and secure information flow
Access control mechanisms are often used with the intent of enforcing confidentiality and integrity policies, but few rigorous connections have been made between information flow and runtime access control. The Java virtual machine and the .NET runtime system provide a dynamic access control mechanism in which permissions are granted to program units and a runtime mechanism checks permissions of code in the calling chain. We investigate a design pattern by which this mechanism can be used to achieve confidentiality and integrity goals: a single interface serves callers of more than one security level and dynamic access control prevents release of high information to low callers. Programs fitting this pattern would be rejected by previous flow analyses. We give a static analysis that admits them, using permission-dependent security types. The analysis is given for a class-based object-oriented language with features including inheritance, dynamic binding, dynamically allocated mutable objects, type casts and recursive types. The analysis is shown to ensure a noninterference property formalizing confidentiality and integrity.(Published Online March 3 2005)
1 Supported in part by NSF grants CCR-0209205 and NSF Career award CCR-0296182.
2 Supported in part by the National Science Foundation under grants CCR-0208984 and CCR-ITR-0326540, the Office of Naval Research under grant N00014-01-1-0837, and the NJ Commission on Science and Technology.