IFDB: Decentralized Information Flow Control for Databases
Name
Liskov_IFDB.pdf
Size
408.44 KB
Format
Adobe PDF
Checksum (MD5)
8499c7f074ee7b544866e46f520cb5ab
Author(s)
Schultz, David
Liskov, Barbara H.
Date Issued
April 2013
Journal
Proceedings of the 8th ACM European Conference on Computer Systems (EuroSys '13)
Publisher
Association for Computing Machinery (ACM)
Citation
David Schultz and Barbara Liskov. 2013. IFDB: decentralized information flow control for databases. In Proceedings of the 8th ACM European Conference on Computer Systems (EuroSys '13). ACM, New York, NY, USA, 43-56.
Version
Author's final manuscript
Abstract
Numerous sensitive databases are breached every year due to bugs in applications. These applications typically handle data for many users, and consequently, they have access to large amounts of confidential information.
This paper describes IFDB, a DBMS that secures databases by using decentralized information flow control (DIFC). We present the Query by Label model, which introduces new abstractions for managing information flows in a relational database. IFDB also addresses several challenges inherent in bringing DIFC to databases, including how to handle transactions and integrity constraints without introducing covert channels.
We implemented IFDB by modifying PostgreSQL, and extended two application environments, PHP and Python, to provide a DIFC platform. IFDB caught several security bugs and prevented information leaks in two web applications we ported to the platform. Our evaluation shows that IFDB's throughput is as good as PostgreSQL for a real web application, and about 1% lower for a database benchmark based on TPC-C.
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/2465351.2465357
