Precise, dynamic information flow for database-backed applications
Name
Solar-Lezama_Precise, dynamic.pdf
Size
365.11 KB
Format
Adobe PDF
Checksum (MD5)
ce6f70d28c35ded333fa60f2e5bd3ee1
Author(s)
Yang, Jean
Hance, Travis
Austin, Thomas H.
Flanagan, Cormac
Chong, Stephen
Solar Lezama, Armando
Date Issued
June 2016
Journal
Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation - PLDI 2016
Publisher
Association for Computing Machinery
Citation
Yang, Jean, et al. Precise, "Dynamic Information Flow for Database-Backed Applications." Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation, 13-17 June 2016, Santa Barbara, CA, ACM Press, 2016, pp. 631–47.
Version
Original manuscript
Abstract
We present an approach for dynamic information flow control across the application and database. Our approach reduces the amount of policy code required, yields formal guarantees across the application and database, works with existing relational database implementations, and scales for realistic applications. In this paper, we present a programming model that factors out information flow policies from application code and database queries, a dynamic semantics for the underlying $^JDB$ core language, and proofs of termination-insensitive non-interference and policy compliance for the semantics. We implement these ideas in Jacqueline, a Python web framework, and demonstrate feasibility through three application case studies: a course manager, a health record system, and a conference management system used to run an academic workshop. We show that in comparison to traditional applications with hand-coded policy checks, Jacqueline applications have 1) a smaller trusted computing base, 2) fewer lines of policy code, and 2) reasonable, often negligible, additional overheads. Keywords: Web frameworks, information flow
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/2908080.2908098
