From Dynamic to Static and Back: Riding the Roller Coaster of Information-Flow Control Research

Abstract. Historically, dynamic techniques are the pioneers of the area of information flow in the 70's. In their seminal work, Denning and Denning suggest a static alternative for information-flow analysis. Following this work, the 90's see the domination of static techniques for information flow. The common wisdom appears to be that dynamic approaches are not a good match for security since monitoring a single path misses public side effects that could have happened in other paths. Dynamic techniques for information flow are on the rise again, driven by the need for permissiveness in today's dynamic applications. But they still involve nontrivial static checks for leaks related to control flow. This paper demonstrates that it is possible for a purely dynamic enforcement to be as secure as Denning-style static information-flow analysis, despite the common wisdom. We do have the trade-off that static techniques have benefits of reducing runtime overhead, and dynamic tech...

• Type: Journal
• Year: 2009
• Where: ERSHOV
• Authors: Andrei Sabelfeld, Alejandro Russo
• Keywords: Dynamic Techniques, ERSHOV 2009, Information Flow, Information-flow Analysis, Theoretical Computer Science