A Calculus for Flow-Limited Authorization: Technical Report

Other Titles
Abstract

Real-world applications routinely make authorization decisions based on dynamic computation. Reasoning about dynamically computed authority is challenging. Integrity of the system might be compromised if attackers can improperly influence the authorizing computation. Confidentiality can also be compromised by authorization, since authorization decisions are often based on sensitive data such as membership lists and passwords. Previous formal models for authorization do not fully address the security implications of permitting trust relationships to change, which limits their ability to reason about authority that derives from dynamic computation. Our goal is a way to construct authorization mechanisms that do not violate confidentiality or integrity. We introduce the Flow-Limited Authorization Calculus (FLAC), which is both a simple, expressive model for reasoning about dynamic authorization and also a language for securely implementing various authorization mechanisms. FLAC is an extension of the Dependency Core Calculus, incorporating the Flow-Limited Authorization Model. FLAC provides strong end-to-end information security guarantees even for programs that incorporate and implement rich dynamic authorization mechanisms. These guarantees include noninterference and robust declassification, which prevent attackers from influencing information disclosures in unautho- rized ways. We prove these security properties formally for all FLAC programs and explore the expressiveness of FLAC with several examples.

Journal / Series
Volume & Issue
Description
Sponsorship
This work was supported by grant N00014-13-1-0089 from the Office of Naval Resesearch, by MURI grant FA9550-12-1-0400, and by a grant from the National Science Foundation (CCF-0964409).
Date Issued
2016-02-13
Publisher
Keywords
authorization; information flow control; security; trust management; language-based security
Location
Effective Date
Expiration Date
Sector
Employer
Union
Union Local
NAICS
Number of Workers
Committee Chair
Committee Co-Chair
Committee Member
Degree Discipline
Degree Name
Degree Level
Related Version
Related DOI
Related To
Related Part
Based on Related Item
Has Other Format(s)
Part of Related Item
Related To
Related Publication(s)
Link(s) to Related Publication(s)
References
Link(s) to Reference(s)
Previously Published As
Government Document
ISBN
ISMN
ISSN
Other Identifiers
Rights
Rights URI
Types
Accessibility Feature
Accessibility Hazard
Accessibility Summary
Link(s) to Catalog Record

Version History

Now showing 1 - 3 of 3
VersionDateSummary
2016-09-13 13:09:10
Authors corrected an error in the statement of Theorem 2.
2016-05-10 08:26:41
Authors corrected some minor errors, and clarified a few concepts based on reviews.
1*
2016-02-13 12:44:18
* Selected version