[Paper Review] Flexible Dynamic Information Flow Control in the Presence of Exceptions

Deian Stefan, Alejandro Russo+2 more|arXiv (Cornell University)|Jul 5, 2012

Security and Verification in Computing13 references4 citations

TL;DR

This paper proposes a dynamic, floating-label information flow control system using a labeled IO monad (LIO) in Haskell, which enforces confidentiality and integrity through runtime label tracking and clearance bounds. It introduces novel support for labeled exceptions and mutable references, proving non-interference and confinement theorems, and demonstrates practicality via a secure conference review system (λChair).

ABSTRACT

We describe a new, dynamic, floating-label approach to language-based information flow control. A labeled IO monad, LIO, keeps track of a current label and permits restricted access to IO functionality. The current label floats to exceed the labels of all data observed and restricts what can be modified. Unlike other language-based work, LIO also bounds the current label with a current clearance that provides a form of discretionary access control. Computations may encapsulate and pass around the results of computations with different labels. In addition, the LIO monad offers a simple form of labeled mutable references and exception handling. We give precise semantics and prove confidentiality and integrity properties of a call-by-name λ-calculus and provide an implementation in Haskell.

Motivation & Objective

• Address the limitations of static information flow control in dynamic environments where users and data types are added at runtime.
• Provide a flexible, practical language-based IFC system that supports dynamic label creation and enforcement without sacrificing security.
• Introduce clearance as a discretionary access control mechanism to bound the current label and limit exposure to sensitive data.
• Enable safe handling of exceptions and mutable state within a secure, labeled computation model.
• Demonstrate the approach through a real-world application: a secure online conference review system with dynamic access control based on conflicts of interest and reviewer assignments.

Proposed method

• Design a labeled IO monad (LIO) that tracks a current label and enforces that all observed or modified data has a label less than or equal to the current label.
• Introduce a clearance mechanism that bounds the current label within a lexical scope, enforcing discretionary access control and limiting the attack surface.
• Implement a toLabeled operator to encapsulate results of computations with higher labels, enabling safe passing of sensitive data across label boundaries.
• Support labeled mutable references and exception handling, where exceptions are labeled with the current label to prevent information leakage.
• Formalize the system in a call-by-name λ-calculus with labeled types and prove non-interference and confinement theorems.
• Implement the LIO library entirely in Haskell using type safety, demonstrating that the entire system can be built as a library without language extensions.

Experimental results

Research questions

• RQ1 How can a dynamic, floating-label IFC system be designed to support runtime creation of labels based on user input or context?
• RQ2 Can a clearance mechanism be integrated into a language-based IFC system to provide discretionary access control and reduce the risk of covert channels?
• RQ3 How can exceptions be safely handled in a dynamic IFC system without leaking sensitive information through exception labels?
• RQ4 To what extent can labeled mutable references be safely supported in a dynamic IFC model without violating non-interference?
• RQ5 Can a purely library-based approach to IFC in Haskell achieve strong security guarantees while remaining practical and composable?

Key findings

• The LIO system enforces non-interference, proving that lower-level results cannot depend on higher-level inputs, thus preventing information leakage.
• The clearance mechanism effectively limits the label of any computation within a scope, providing a form of discretionary access control that reduces the trusted code surface.
• The system supports safe exception handling by labeling exceptions with the current label, preventing information leakage through exception channels.
• The toLabeled operator enables safe encapsulation and passing of results from high-label computations, allowing fine-grained control over label propagation.
• The formal model and implementation demonstrate that dynamic IFC can be both expressive and secure, with security guarantees comparable to static approaches.
• The λChair system prototype shows that the model can securely manage dynamic access control in real-world scenarios involving conflicts of interest and reviewer assignments.