Tight Enforcement of Information-Release Policies for Dynamic Languages

• Published in: 2009 22nd IEEE Computer Security Foundations Symposium pp. 43 - 59
• Main Authors: Askarov, A., Sabelfeld, A.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.07.2009
• Subjects: Acoustical engineering; Communication system security; Computer science; Computer security; Credit cards; declassification; Information analysis; information flow; Information security; Java; language-based security; Monitoring; Remuneration

This paper studies the problem of securing information release in dynamic languages. We propose (i) an intuitive framework for information-release policies expressing both what can be released by an application and where in the code this release may take place and (ii) tight and modular enforcement...