Paper Info
Title
Precise, Dynamic Information Flow for Database-Backed Applications
Abstract
We present an approach for dynamic information flow control across the application and database. Our approach reduces the amount of policy code required, yields formal guarantees across the application and database, works with existing relational database implementations, and scales for realistic applications. In this paper, we present a programming model that factors out information flow policies from application code and database queries, a dynamic semantics for the underlying $^JDB$ core language, and proofs of termination-insensitive non-interference and policy compliance for the semantics. We implement these ideas in Jacqueline, a Python web framework, and demonstrate feasibility through three application case studies: a course manager, a health record system, and a conference management system used to run an academic workshop. We show that in comparison to traditional applications with hand-coded policy checks, Jacqueline applications have 1) a smaller trusted computing base, 2) fewer lines of policy code, and 2) reasonable, often negligible, additional overheads.
Year
DOI
Venue
2016
10.1145/2980983.2908098
PLDI
Keywords
Field
DocType
Web frameworks,information flow
Information flow (information theory),Programming language,Relational database,Programming paradigm,Computer science,Implementation,Theoretical computer science,Mathematical proof,Trusted computing base,Database,Semantics,Python (programming language)
Conference
Volume
Issue
ISSN
51
6
0362-1340
Citations 
PageRank 
References 
7
0.44
31
Authors
6
Name
Order
Citations
PageRank
Jean Yang11077.90
travis hance270.44
Thomas H. Austin330715.96
Armando Solar-Lezama479159.48
Cormac Flanagan52990181.36
Stephen Chong659930.36