An Approach to Tracing Information Flows of Untrustworthy Data in Programs

摘要

As the role of software increases in computing environments, issues in software security become more important problems. Taint analysis is a technique to trace and manage tainted data originated from untrustworthy sources in a program. This analysis can be applied to software security verification as well as software behavior understanding, testing unexpected errors, or debugging. In this paper, we present a method for tracing information flows of untrustworthy data in a base language. In addition, we verify the correctness of the proposed algorithm by implementing an analyzer, and show that propagation of untrustworthy data can be traced by the proposed algorithm. The proposed trace algorithm can be applied to understand the analysis procedures of information flows of untrustworthy data, and it can be used in software analysis to detect security problems that is caused by misuse of information in software or system.