Paper Info
Title
A Library for Secure Multi-threaded Information Flow in Haskell
Abstract
Li and Zdancewic have recently proposed an approach to provide information-flow security via a library rather than producing a new language from the scratch. They have shown how to implement such a library in Haskell by using arrow combinators. However, their approach only works with computations that have no side-effects. In fact, they leave as an open question how their library, and the mechanisms in it, need to be modified to consider these kind of effects. Another absent feature in the library is support for multithreaded programs. Information-flow in multi-threaded programs still remains as a challenge, and no support for that has been implemented yet. It is not surprising, then, that the two main stream compilers that provide information-flow security, Jif and FlowCaml, lack support for multithreading. Following ideas taken from literature, this paper presents an extension to Li and Zdancewic's library that provides information-flow security in presence of reference manipulation and multithreaded programs. Moreover, an onlineshopping case study has been implemented to evaluate the proposed techniques. The case study reveals that exploiting concurrency to leak secrets is feasible and dangerous in practice and how our extension helps avoiding that. To the best of our knowledge, this is the first implemented tool to guarantee information-flow security in concurrent programs and the first implementation of a case study that involves concurrency and information-flow policies.
Year
DOI
Venue
2007
10.1109/CSF.2007.6
CSF
Keywords
Field
DocType
information-flow security,concurrent program,multithreaded program,arrow combinators,proposed technique,lack support,onlineshopping case study,information-flow policy,secure multi-threaded information flow,case study,absent feature,computer security,computer languages,information flow,data security,electronic commerce,side effect,concurrency,information security,concurrency control,concurrent computing,java,multi threading,multithreading,computer science
Multithreading,Information flow (information theory),Arrow,Programming language,Concurrency control,Concurrency,Combinatory logic,Computer science,Compiler,Haskell
Conference
ISBN
Citations 
PageRank 
0-7695-2819-8
17
0.68
References 
Authors
27
3
Name
Order
Citations
PageRank
Ta-chung Tsai1171.02
Alejandro Russo274635.22
John Hughes31573174.22