Skip to main content
Article
Multiple facets for dynamic information flow
39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (2012)
  • Thomas H. Austin, University of California, Santa Cruz
  • Cormac Flanagan, University of California, Santa Cruz
Abstract
JavaScript has become a central technology of the web, but it is also the source of many security problems, including cross-site scripting attacks and malicious advertising code. Central to these problems is the fact that code from untrusted sources runs with full privileges. We implement information flow controls in Firefox to help prevent violations of data confidentiality and integrity. Most previous information flow techniques have primarily relied on either static type systems, which are a poor fit for JavaScript, or on dynamic analyses that sometimes get stuck due to problematic implicit flows, even in situations where the target web application correctly satisfies the desired security policy. We introduce faceted values, a new mechanism for providing information flow security in a dynamic manner that overcomes these limitations. Taking inspiration from secure multi-execution, we use faceted values to simultaneously and efficiently simulate multiple executions for different security levels, thus providing non-interference with minimal overhead, and without the reliance on the stuck executions of prior dynamic approaches.
Keywords
  • Security,
  • System security,
  • Privacy,
  • informations,
  • Javascript,
  • technology,
  • Firefox
Disciplines
Publication Date
2012
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Thomas H. Austin and Cormac Flanagan. "Multiple facets for dynamic information flow" 39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages Vol. 47 Iss. 1 (2012)
Available at: http://works.bepress.com/thomas_austin/8/