[Paper Review] A Permission-Dependent Type System for Secure Information Flow Analysis

Hongxu Chen, Alwen Tiu+2 more|arXiv (Cornell University)|Sep 27, 2017

Advanced Malware Detection Techniques7 references3 citations

TL;DR

This paper presents a permission-dependent type system for enforcing secure information flow in Android applications by integrating Android's permission model into a lattice-based security typing framework. It introduces a novel conditional typing rule with a merging operator on security types, enabling precise enforcement of policies that depend on runtime permission checks, and proves soundness via noninterference. The system supports type inference through constraint solving, enabling static detection of information leaks in imperative code.

ABSTRACT

We introduce a novel type system for enforcing secure information flow in an imperative language. Our work is motivated by the problem of statically checking potential information leakage in Android applications. To this end, we design a lightweight type system featuring Android permission model, where the permissions are statically assigned to applications and are used to enforce access control in the applications. We take inspiration from a type system by Banerjee and Naumann (BN) to allow security types to be dependent on the permissions of the applications. A novel feature of our type system is a typing rule for conditional branching induced by permission testing, which introduces a merging operator on security types, allowing more precise security policies to be enforced. The soundness of our type system is proved with respect to a notion of noninterference. In addition, a type inference algorithm is presented for the underlying security type system, by reducing the inference problem to a constraint solving problem in the lattice of security types.

Motivation & Objective

• To address information flow leaks in Android applications, particularly those arising from conditional logic guarded by permission checks.
• To design a lightweight, statically analyzable type system that integrates Android's permission model with security typing to prevent both explicit and implicit information flows.
• To enable more precise security policies by allowing security types to depend on the presence or absence of specific permissions.
• To support type inference via constraint solving, making the system practical for real-world Android app analysis.
• To provide a formal soundness proof based on noninterference, ensuring that typable programs do not leak sensitive information.

Proposed method

• The type system extends a lattice-based security typing model with permissions as guards, allowing security types to vary depending on which permissions are enabled.
• A new typing rule for conditional statements incorporates permission testing, using a merging operator on security types to combine branches with different sensitivity levels.
• Security types are parameterized by permission sets, allowing functions to have multiple types depending on the caller’s permission context.
• The system models noninterference as a safety property, ensuring that low-security outputs do not depend on high-security inputs in a way that leaks information.
• Type inference is reduced to a constraint-solving problem over the lattice of security types, enabling automated analysis without manual type annotations.
• The framework is designed to be extensible, with ongoing work on supporting global variables, heaps, and object-oriented features.

Experimental results

Research questions

• RQ1 How can a type system be designed to enforce secure information flow in Android apps where access to sensitive data depends on runtime permission checks?
• RQ2 Can a permission-dependent type system support more precise security policies than traditional noninterference type systems that assume uniform security levels across conditionals?
• RQ3 How can conditional branching with permission checks be statically analyzed to prevent implicit information flows without over-approximating security levels?
• RQ4 Is it possible to design a type inference algorithm for such a system that reduces the typing problem to constraint solving over a lattice of security types?
• RQ5 Can the system be extended to support complex language features like global variables and dynamic permission granting while preserving soundness?

Key findings

• The proposed type system successfully enforces noninterference by allowing security types to depend on the permission context of the calling application.
• The novel merging operator on security types enables more precise typing of conditionals where branches have different sensitivity levels, avoiding over-approximation of the return type.
• The system supports static analysis of information flow in Android apps without requiring runtime changes or collaboration with app stores.
• A type inference algorithm is developed by reducing the typing problem to constraint solving over a lattice of security types, enabling automation.
• The framework is sound with respect to noninterference, ensuring that no information leakage occurs in typable programs.
• The approach is extensible, with ongoing work showing that global variables and other language features can be integrated while maintaining security guarantees.