CONTROLLING INFORMATION FLOWS DURING SOFTWARE DEVELOPMENT

Size: px

Start display at page:

Download "CONTROLLING INFORMATION FLOWS DURING SOFTWARE DEVELOPMENT"

Betty Bertha Johns
5 years ago
Views:

1 CONTROLLING INFORMATION FLOWS DURING SOFTWARE DEVELOPMENT Shh-Chen Chou Department of Computer Scence and Informaton Engneerng, Natonal Dong Hwa Unversty, Tawan ABSTRACT Informaton flow control (IFC) s useful n preventng nformaton leakage durng software executon. Our survey reveals that no IFC model s appled on the entre software development process. Applyng an IFC model on the entre software development process offers the followng features: (1) vewponts of all stakeholders (.e., customers and analysts) can be ncluded and (2) the IFC model helps correctng statements that may leak nformaton durng every development phase. In addton that no IFC model s appled to the entre software development process, we faled to dentfy an IFC model that can reduce runtme overhead. Accordng to the above descrpton, we desgned a new IFC model named PrcIFC (process IFC). PrcIFC s appled on the entre software development process. Moreover, PrcIFC s dsabled after software testng to reduce runtme overhead. KEYWORDS Software securty, nformaton flow control, software development process, reduce runtme overhead 1. INTRODUCTION Informaton securty covers many ssues such as cryptography, authentcaton, and access control. Informaton flow control (IFC) s a branch of access control. It prevents nformaton leakage durng software executon. Informaton leakage occurs when persons or other software llegally obtan senstve nformaton from a software system. In general, persons can obtan nformaton from fles or output devces and software can obtan nformaton from fles. Informaton leakage may thus happen when senstve nformaton s output. In the early days, IFC s appled n a sngle system. In the recent years, IFC has been appled to operatng systems [1-3], web servces [4-7], and even cloud applcatons [8-9]. In other words, IFC has been appled to the entre Internet. IFC s thus essental n nformaton securty. We nvolved n the research of IFC for years and dentfed that no IFC model s appled on the entre software development process. Applyng IFC on the entre software development process offers the followng features: (1) vewponts of all stakeholders (.e., customers and analysts) can be ncluded and (2) the IFC model helps correctng statements that may leak nformaton durng every development phase. We also dentfed that no IFC model take runtme overhead reducng nto consderaton, n whch the overhead s nduced by embeddng IFC models n software. We thus desgned a new IFC model to overcome the problems mentoned above. The desgn s based on the followng consderatons: DOI : /jsptm

2 a. Embeddng the IFC model nto software specfcatons and desgn documents. Tradtonal models are embedded n software only, whch may exclude the vewponts of some stakeholders. b. Executng the specfcatons and desgn documents n whch the IFC model s embedded. Ths executon causes the IFC correctness of specfcatons and desgn documents to be checked. c. Embeddng the IFC model n the software durng testng. The testng thus tests both the correctness of functons and IFC. After testng, the model s dsabled to remove runtme overhead nduced by IFC model. As descrbed n term c above, the IFC model proposed n ths paper s dsabled after testng. Nevertheless, software that passes the testng s not ensured to be correct. Therefore, the operatng system should ntercept software output nformaton to ensure securty (OS ntercepts only output nformaton because only output nformaton may be leaked to persons or other software). In our research, we desgn the IFC model and let the OS ntercepton as a future work. Snce the model s appled n the entre software development process, we name t PrcIFC (process IFC). The core of PrcIFC s the same as NetIFC [10] we desgned before. When desgnng PrcIFC, we gnored the affect of vruses and Trojan horses because they belong to other research areas. Durng the development of PrcIFC, we dentfed the followng facts. a. Snce only output nformaton may be leaked (to persons or other programs), only output statements need to be controlled. As to other statements, the jon operaton [11] should be used to adjust varable senstvty after executon. Ths adjustment prevents possble nformaton leakage when the varable s output later. b. Informaton should be separated n dfferent group for compatblty. For example, prces wth the unts of USD and EUR are ncomparable. Accordng to the facts, PrcIFC controls output statements and uses jon operatons to adjust nformaton senstvty for other statements. PrcIFC presented n ths paper offers the followng major features: a. PrcIFC s appled on the entre software development process. Therefore, t wll not exclude the vewponts of any stakeholders and helps correctng statements that may leak nformaton durng every phase of the development. b. PrcIFC s removed when software s onlne, whch remove runtme overhead. 2. RELATED WORK Tradtonal lattce-based model [12-13] s a MAC (mandatory access control) whch s crtczed as too restrcted. The decentralzed label model [11, 14] uses labels to mark the securty levels of varables. A label s composed of polces to be smultaneously obeyed. The model n [15] uses ACLs of objects to compute ACLs of executons. The model Trust-Serv [16] uses state machnes to dynamcally choose web servces at run tme. It uses trust negotaton [17] to select web servces that can be nvoked. The kernel component to determne whether a web servce can be nvoked s credental. The model proposed n [18] uses dgtal credentals for negotaton. It defnes strateges for negotaton polces. SCIFC [6] uses varous mechansm and algorthms to make sure whether a servce chan can be successfully nvoked. 2

3 Flume [1] s a decentralzed nformaton flow control (DIFC) model for operatng systems. It tracks nformaton flows n a system usng tags and labels. The control granularty s detaled to processes. The secrecy tags prevent nformaton leakage and ntegrty tags prevent nformaton corrupton. Flume also avods nformaton leaked to untrusted channel. The functon of Lamnar [2] s smlar to that of Flume. The model proposed n [19] uses X-GTRBAC [20] to control the access of web servces. X- GTRBAC can be used n heterogeneous and dstrbuted stes. Moreover, t apples TRBAC [21] to control the factor related to tme. The model n [22] uses RBAC (role-based access control) concept [23-24] to defne polces of accessng a web servce. It s a two-levelled mechansm. The frst level checks the roles assgned to requesters and web servces. The second level uses parameters as attrbutes and assgns permssons to the attrbutes. An authorzed requester can nvoke a web servce only when t possesses the permssons to access the attrbutes. The model n [25] dentfes dependences among I/O parameters of servces to decde whether servce nvocatons wll leak nformaton. The model n [26] offers functons to check ntracomponent nformaton flows through the JIF language [27]. The model n [8] appled the Chnese Wall model [28] to control nformaton flows n the IaaS level. As to servces n the SaaS level, the model cannot control ther nformaton flows. In the recent survey of [9], the authors especally emphasze the mportance of data prvacy n a cloud computng envronment. They beleved that nformaton flow control s a good soluton for the problem. However, the artcle dd not propose a concrete nformaton flow control model. Accordng to our survey, no research apples IFC n the entre software development process and almost no one dscusses runtme overhead. Fgure 1. Desgn Phlosophy Of Prcfc 3

4 3. PRCIFC Fgure 1 depcts the desgn phlosophy of PrcIFC. Before descrbng Fgure 1, we assume that software development tools, such as the UML development platform, are trusted. Therefore, PrcIFC needs not handle possble problems nduced by software development tools. Fgure 1 shows that we embed PrcIFC n specfcatons then execute them. To execute a specfcaton, we use our rapd prototypng language [29] to wrte the specfcaton. That s, we embed PrcIFC n our prototypng language. If a specfcaton passes the test of both functonal and IFC requrements, the specfcaton can be desgned. Otherwse, the requrement should be re-analyzed. Durng the desgn, we use the target language (such as C) to wrte the desgn documents and embed PrcIFC n the documents. The documents are then executed and tested. If the desgn documents pass the test of both functonal and IFC requrements, the desgn document can be mplemented. Otherwse, the desgn actvty should be repeated. Durng mplementaton, PrcIFC s embedded n the programs. The programs are then executed. If the programs pass the test of both functonal and IFC requrements, the programs are released to the customers as a software system. Before the software system s onlne, PrcIFC s dsabled to completely remove the runtme overhead. When the software s onlne, the OS ntercepts the output of the software to check possble nformaton leakage. However, the ntercepton s out of the scope of ths paper. Accordng to the descrpton n secton 1, nformaton should be assocated wth a mechansm to represent ts senstvty. The senstvty should nclude a securty level number and group. Moreover, we need a jon operaton to adjust the senstvty of varables n non-output statements. In ths regard, we let a varable s senstvty be (Sln, Gv), n whch Sln s the securty level number whereas Gv s the group. We call the senstvty a securty level. Therefore, every pece of nformaton that should be protected s assocated wth a securty level. The defnton of securty levels results n a lattce. Accordng to the lattce, only output statements are controlled strctly and other statements apples the jon operaton to adjust the securty level of varables. Suppose a pece of nformaton derved from the varable set {b b s a varable assocated wth the securty level (Slv b, Gv ) b } s outputtng to the port a (here a port s a devce or a fle), whch s assocated wth a securty level (S lv, Gv a a). Then, PrcIFC wll check the securty of the output statement usng the followng rule Rule 1. Gp Gp φ ) ( MAX ( Slv ) Slv ) (1) ( b a b a The former part of the rule requres that the output port a and the varables b n the varable set should be compatble. Otherwse, the outputtng s llegal. The latter part requres that the securty level number of the output port should be at least the same as the varables n the varable set. Ths prevents leakng nformaton carred by b to an output port. As to non-output statement, suppose a pece of nformaton a, whch s assocated wth a securty level (S lv, Gv a a ), s derved from the varable set {b b s a varable assocated wth the securty level (Slv b, Gv ) b }. Then, PrcIFC requres that the condton ( Gpb Gpa φ) to be true, whch means that the nformaton a and varables b n the varable sets are compatble. If the condton s true, the followng rule s used to adjust the securty of the nformaton a. Rule 2. Slv a = MAX Slv b ) (2) ( 4

5 4. PROVE OF CORRECTNESS Informaton leakage may occur durng output, ncludng outputtng to fles and devces. Case 1. Outputtng nformaton to a devce wll not leak nformaton under the control of PrcIFC. Proof. Informaton output to a devce Dv may only leak to persons. Suppose person P possesses a securty level number SLV p and SLV p < Slv Dv. If Dv and all nformaton sources are n the same group, Rule 1 allows the output only when MAX ( Slv b ) Slv Dv. If the output s allowed, P cannot access nformaton output to Dv because SLV p < Slv Dv. Snce b derves the nformaton output to Dv, no b wll be leaked to P. Case 2. Outputtng nformaton to fle wll not leak nformaton under the control of PrcIFC. Proof. Informaton output to a fle F may be leaked to persons or software. If F and all sources are n the same group, Rule 1 allows the output only when MAX ( Slv b ) Slv F. Case 1 above states that no b wll be leaked to a person P wth a securty level number SLV p and SLV p < Slv F. On the other hand, f the software Sf ntends to read the nformaton of V from F to the varable V 1, Rule 2 causes Slv to be the same as Slv. If Sf outputs V 1 to a v devce, Case 1 states that V 1 wll not be leaked to a person. If V 1 s output to another fle, the proof goes back to the begnnng of ths proof. However, we know that the nformaton of a senstve varable may be: (a) operatng by a software system, (b) output to a devce, or (c) output to a fle. Informaton operatng by a software system wll not be leaked wthout output. Informaton output to a devce wll not be leaked (see Case 1). As to the nformaton output to a fle, t wll not be leaked to persons. # 5. EXPERIMENT RESULTS We requred students to develop a smple lbrary system usng UML as the development model. The target language s C. We organzed two groups of students for the experment, n whch every group was conssted of ten students. For the frst group, we requred students to develop the system wthout PrcIFC. PrcIFC was embedded n ther systems durng mplementaton. That s, the students needed not use the prototypng language to wrte specfcatons and needed not use the target language to wrte desgn documents. On the other hand, we requred students n the other group to follow the process n Fgure 1 to develop ther software. Durng software development, we requred the students to collect the tme they develop documents. Durng testng, we requred students to collect the number of statements that volate PrcIFC. The collected data were then averaged. Table 1 depcts the averaged data, n whch the development tme of the frst group s normalzed to one. Table 1. Experment result v 1 Group Requrement analyss tme System desgn tme Implementaton tme Statements volatng PrcIFC

6 Table 1 shows that the requrement analyss and desgn tme of the second group was more than that of the frst group. Ths s reasonable because students n the group should wrte ther specfcatons and desgn documents usng the prototypng language and the target language, respectvely. Moreover, PrcIFC should be embedded n the languages. On the other hand, the mplementaton tme of the second group was much less because the desgn documents had been wrtten n the target language. Moreover, students n the frst group should embed PrcIFC n ther systems. What we especally concerned s the statements that volate PrcIFC. The experment result exercses us and we beleve that PrcIFC s ndeed valuable, because many statements that may leak nformaton have been removed durng software development phases before mplementaton. 6. CONCLUSION Informaton flow control (IFC) s useful n preventng nformaton leakage durng software executon. Accordng to our survey, we cannot dentfy an IFC model that s appled on the entre software development process. Applyng IFC model on the entre software development process wll not exclude the vewponts of any stakeholders. Moreover, statements that may leak nformaton can be dentfed durng every phase of software development. The other problem of tradtonal IFC models s large runtme overhead. We cannot dentfy a model that can remove ths overhead. Accordng to the descrpton above, we desgn a new IFC model named PrcIFC (process IFC). It offers the followng major features: 1. PrcIFC s appled on the entre software development process. Therefore, t wll not exclude the vewponts of any stakeholders and helps correctng statements that may leak nformaton durng every phase of the development. 2. PrcIFC s dsabled when software s onlne, whch remove runtme overhead. In the future, we wll requre students to apply PrcIFC on ther exercses for checkng the advantages and dsadvantages of the model n depth. We hope to mprove PrcIFC from the responses of students. REFERENCES [1] M. Krohn, A. Yp, M. Brodsky, and N. Clffer, M. F. Kaashoek, E. Kohler, and R. Morrs, Informaton Flow Control for Standard OS Abstractons, SOSP 07, [2] I. Roy, D. E. Porter, M. D. Bond, K. S. McKnley, and E. Wtchel, Lamnar: Practcal Fne-Graned Decentralzed Informaton Flow Control, PLDI 09, [3] N. Zeldovch, S. Boyd-Wckzer, and D. Mazères, Securng Dstrbuted Systems wth Informaton Flow Control, NSDI '08, pp , 2008 [4] S. C. Chou and C. H. Huang, An Extended XACML Model to Ensure Secure Informaton Access for Web Servces, Journal of Systems and Software, vol. 83, no. 1, pp , [5] S. C. Chou, Dynamcally Preventng Informaton Leakage for Web Servces usng Lattce, to appear n 5 th Internatonal Conference on Computer Scences and Convergence Informaton Technology (ICCIT), [6] W. She, I. L. Yen, B. Thurasngham, and E. Bertno, The SCIFC Model for Informaton Flow Control n Web Servce Composton, 2009 IEEE Internatonal Conference on Web Servces, [7] W. She, I. L. Yen, B. Thurasngham, and E. Bertno, Effectve and Effcent Implementaton of an Informaton Flow Control Protocol for Servce Composton, IEEE Internatonal Conference on Servce- Orented Computng and Applcatons,

7 [8] R. Wu, G. J., Ahn, H. Hu, and M. Snghal, Informaton Flow Control n Cloud Computng, Proceedngs of the 6th Internatonal Conference on Collaboratve Computng: Networkng, Applcatons and Worksharng, 2010 [9] J. Bacon, D. Eyers, T. F. J. M. Pasquer, J. Sngh, and P. Pezuch, Informaton Flow Control for Secure Cloud Computng, IEEE Trans. Network and Servce Management, 11(1), pp , [10] S. -C. Chou, Controllng Informaton Flows n Net Servces wth Low Runtme Overhead, Internatonal Journal of Computer Network and Informaton Securty, vol. 7, no. 3, pp. 1-9, [11] Myers A., and Lskov, B., Complete, Safe Informaton Flow wth Decentralzed Labels. Proc. 14 th IEEE Symp. Securty and Prvacy, [12] D. E., Dennng, A Lattce Model of Secure Informaton Flow, Comm. ACM, vol. 19, no. 5, , [13] D. E., Dennng, P. J., and Dennng, Certfcaton of Program for Secure Informaton Flow, Comm. ACM, vol. 20, no. 7, , [14] Myers A., and Lskov, B., Protectng Prvacy usng the Decentralzed Label Model. ACM Trans. Software Eng. Methodology, vol. 9, no. 4, [15] Samarat, P., Bertno, E., Campchett, A., and Jajoda, S., Informaton Flow Control n Object- Orented Systems. IEEE Trans. Knowledge Data Eng., vol. 9, no. 4, [16] Samarat, P., Bertno, E., Campchett, A., and Jajoda, S., Informaton Flow Control n Object- Orented Systems. IEEE Trans. Knowledge Data Eng., vol. 9, no. 4, [17] Yu, T., Wnslett, M., Seamons, K., Supportng Structured Credentals and Senstve Polces through Interoperable Strateges for Automated Trust Negotaton. ACM Transactons on Informaton and System Securty, vol. 6, no. 1, [18] Koshutansk, H., Massacc, F., Interactve Credental Negotaton for Stateful Busness Processes, Lecture notes n computer scence, [19] Bhatt, R., Bertno, E., Ghafoor, A., A Trust-based Context-aware Access Control Model for Web Servces. IEEE ICW 04, [20] Bhatt, R., Ghafoor, A., Bertno, E., Josh, J. B. D., X-GTRBAC: An XML-Based Polcy Specfcaton Framework and Archtecture for Enterprse-Wde Access Control. ACM Transactons on Informaton and System Securty (TISSEC), Vol. 8, No. 2, [21] Bertno, E., Bonatt P. A., Ferrar, E., TRBAC: A Temporal Role-Based Access Control Model. ACM Transactons on Informaton and System Securty, Vol. 4, No. 3, [22] Wonohoesodo R., Tar, Z., A Role Based Access Control for Web Servces. Proceedngs of the 2004 IEEE Internatonal Conference on Servce Computng, [23] Sandhu, R. S., Coyne, E. J., Fensten, H. L., Youman, C. E., Role-Based Access Control Models. IEEE Computer, vol. 29, no. 2, [24] R. Sandhu, D. F., Ferraolo, and D. R., Kuhn, D. "The NIST Model for Role Based Access Control: Toward a Unfed Standard", 5th ACM Workshop Role-Based Access Control. pp , 2000 [25] W. She, I. -L. Yen, B. ThuraSngham, and S. Y. Huang, Rule-Based Run-Tme Informaton Flow Control n Servce Cloud, 2011 IEEE Internatonal Conferences on Web Servces, pp , [26] L. Sfax, T. Abdellatf, R. Robbana, and Y. Lakhnech, Informaton Flow Control of Component-Based Dstrbuted Systems, Concurrency and Computaton: Practce and Experence, avalable on [27] JIF webste, Jf: Java + nformaton flow, avalable on [28] Brewer, D.F.C., Nash, M.J., The Chnese Wall Securty Polcy. In: Proceedngs of the 5 th IEEE Symposum on Securty and Prvacy, [29] S. -C. Chou, A Prototypng Technque to Verfy Requrements, ICS 2002, Hualen, Tawan. AUTHORS Shh-Chen Chou s currently a professor n the Department of Computer Scence and Informaton Engneerng, Natonal Dong Hwa Unversty, Hualen, Tawan. Hs research nterests nclude software engneerng, process envronment, software reuse, and nformaton flow control. 7

An Optimal Algorithm for Prufer Codes *

An Optimal Algorithm for Prufer Codes * J. Software Engneerng & Applcatons, 2009, 2: 111-115 do:10.4236/jsea.2009.22016 Publshed Onlne July 2009 (www.scrp.org/journal/jsea) An Optmal Algorthm for Prufer Codes * Xaodong Wang 1, 2, Le Wang 3,