Updatable Security Views

Security views are a flexible and effective mechanism for controlling access to confidential information. Rather than allowing untrusted users to access source data directly, they are instead provided with a restricted view, from which all confidential information has been removed. The program that generates the view effectively embodies a confidentiality policy for the underlying source data. However, this approach has a significant drawback: it prevents users from updating the data in the view. To address the “view update problem” in general, a number of bidirectional languages have been proposed. Programs in these languages—often called lenses—can be run in two directions: read from left to right, they map sources to views; from right to left, they map updated views back to updated sources. However, existing bidirectional languages do not deal adequately with security. In particular, they do not provide a way to ensure the integrity of source data as it is manipulated ...

• Type: Conference
• Year: 2009
• Where: CSFW
• Authors: J. Nathan Foster, Benjamin C. Pierce, Steve Zdancewic
• Keywords: Bidirectional Languages, Confidential Information, CSFW 2009, Security Privacy, Source Data