Fri 17 Jun 2016 10:30 - 11:00 at Grand Ballroom Santa Ynez - Security Chair(s): Andrew Myers

We present an approach for dynamic information flow control across the application and database. Our approach reduces the amount of policy code required, yields formal guarantees across the application and database, works with existing relational database implementations, and scales for realistic applications. In this paper, we present a programming model that factors out information flow policies from application code and database queries, a dynamic semantics for the underlying $\lambda^JDB$ core language, and proofs of termination-insensitive non-interference and policy compliance for the semantics. We implement these ideas in Jacqueline, a Python web framework, and demonstrate feasibility through three application case studies: a course manager, a health record system, and a conference management system used to run an academic workshop. We show that in comparison to traditional applications with hand-coded policy checks, Jacqueline applications have 1) a smaller trusted computing base, 2) fewer lines of policy code, and 2) reasonable, often negligible, additional overheads.

Fri 17 Jun

Displayed time zone: Tijuana, Baja California change

10:30 - 12:00
SecurityResearch Papers at Grand Ballroom Santa Ynez
Chair(s): Andrew Myers Cornell University
10:30
30m
Talk
Precise, Dynamic Information Flow for Database-Backed Applications
Research Papers
Jean Yang Carnegie Mellon University, Travis Hance Dropbox, Thomas H. Austin , Armando Solar-Lezama MIT, Cormac Flanagan UC Santa Cruz, Stephen Chong Harvard University
Link to publication Media Attached
11:00
30m
Talk
End-to-End Verification of Information-Flow Security for C and Assembly Programs
Research Papers
David Costanzo Yale University, Zhong Shao Yale University, Ronghui Gu Yale University
Pre-print Media Attached
11:30
30m
Talk
A Design and Verification Methodology for Secure Isolated Regions
Research Papers
Rohit Sinha University of California, Berkeley, Manuel Costa Microsoft Research, Akash Lal Microsoft Research India, Nuno P. Lopes Microsoft Research, Sriram Rajamani Microsoft Research, Sanjit Seshia UC Berkeley, Kapil Vaswani Microsoft Research
Media Attached