Dynamic Monitoring of a Declassification Policy

摘要

The declassification policy is the key challenge for language-based information flow security. Current study work on the enforcement of the declassification policy focuses on static information-flow analysis techniques, but the static analysis is over-restrictive and imprecise. Dynamic information-flow analysis techniques offer distinct advantages in precision and permissiveness. To this end. this paper presents a dynamic information-flow monitor to enforce the gradually delimited release policy combining WHAT and WHERE dimensions. The monitor can dynamically monitor the execution of the program to ensure the legitimate release of expected high confidentiality information to expected location of the program. Moreover, we prove soundness of the monitor.