Abstractions for Usable Information Flow Control in Aeolus

Download: pdf.

“Abstractions for Usable Information Flow Control in Aeolus” by Winnie Cheng, Dan R. K. Ports, David Schultz, Victoria Popic, Aaron Blankstein, James Cowling, Dorothy Curtis, Liuba Shrira, and Barbara Liskov. In Proceedings of the 2012 USENIX Annual Technical Conference, (Boston, MA, USA), June 2012.

Abstract

Despite the increasing importance of protecting confidential data, building secure software remains as challenging as ever. This paper describes Aeolus, a new platform for building secure distributed applications. Aeolus uses information flow control to provide confidentiality and data integrity. It differs from previous information flow control systems in a way that we believe makes it easier to understand and use. Aeolus uses a new, simpler security model, the first to combine a standard principal-based scheme for authority management with thread-granularity information flow tracking. The principal hierarchy matches the way developers already reason about authority and access control, and the coarse-grained information flow tracking eases the task of defining a program’s security restrictions. In addition, Aeolus provides a number of new mechanisms (authority closures, compound tags, boxes, and shared volatile state) that support common design patterns in secure application design.

Download: pdf.

BibTeX entry:

@inproceedings{cheng12:_abstr_usabl_infor_flow_contr_aeolus,
   author = {Winnie Cheng and Dan R. K. Ports and David Schultz and
	Victoria Popic and Aaron Blankstein and James Cowling and Dorothy
	Curtis and Liuba Shrira and Barbara Liskov},
   title = {Abstractions for Usable Information Flow Control in {Aeolus}},
   booktitle = {Proceedings of the 2012 USENIX Annual Technical Conference},
   address = {Boston, MA, USA},
   month = jun,
   year = {2012}
}