Extending the Noninterference Version of MLS for SAT
IEEE Transactions on Software Engineering - Special issue on computer security and privacy
On the Identification of Covert Storage Channels in Secure Systems
IEEE Transactions on Software Engineering
A General Theory of Composition for a Class of "Possibilistic" Properties
IEEE Transactions on Software Engineering
Probabilistic noninterference in a concurrent language
Journal of Computer Security
A sound type system for secure flow analysis
Journal of Computer Security
Shared resource matrix methodology: an approach to identifying storage and timing channels
ACM Transactions on Computer Systems (TOCS)
Certification of programs for secure information flow
Communications of the ACM
A lattice model of secure information flow
Communications of the ACM
A note on the confinement problem
Communications of the ACM
Probabilistic Noninterference for Multi-Threaded Programs
CSFW '00 Proceedings of the 13th IEEE workshop on Computer Security Foundations
Dynamic Program Slicing in Understanding of Program Execution
WPC '97 Proceedings of the 5th International Workshop on Program Comprehension (WPC '97)
CSP and determinism in security modelling
SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy
IP covert timing channels: design and detection
Proceedings of the 11th ACM conference on Computer and communications security
Program confinement in KVM/370
ACM '77 Proceedings of the 1977 annual conference
Software Abstractions: Logic, Language, and Analysis
Software Abstractions: Logic, Language, and Analysis
Secure information flow with random assignment and encryption
Proceedings of the fourth ACM workshop on Formal methods in security
Type inference and informative error reporting for secure information flow
Proceedings of the 44th annual Southeast regional conference
Improved typings for probabilistic noninterference in a multi-threaded language
Journal of Computer Security
Improving usability of information flow security in java
Proceedings of the 2007 workshop on Programming languages and analysis for security
Detecting covert timing channels: an entropy-based approach
Proceedings of the 14th ACM conference on Computer and communications security
Handling encryption in an analysis for secure information flow
ESOP'03 Proceedings of the 12th European conference on Programming
Language-based information-flow security
IEEE Journal on Selected Areas in Communications
Secure information flow for distributed systems
FAST'09 Proceedings of the 6th international conference on Formal Aspects in Security and Trust
Analysis of the communication between colluding applications on modern smartphones
Proceedings of the 28th Annual Computer Security Applications Conference
Modeling and validating the clinical information systems policy using alloy
HIS'13 Proceedings of the second international conference on Health Information Science
| Hi-index | 0.00 |
Covert channels can result in unauthorized information flows when exploited by malicious software. To address this problem, we present a precise, formal definition for covert channels, which relies on control flow dependency tracing through program execution, and extends Dennings' and subsequent classic work in secure information flow [9][40][30]. A formal security Domain Model (DM) for conducting static analysis of programs to identify covert channel vulnerabilities is described. The DM is comprised of an Invariant Model, which defines the generic concepts of program state, information flow, and covert channel rules; and an Implementation Model, which specifies the behavior of a target program. The DM is compiled from a representation of the program, written in a domain-specific Implementation Modeling Language (IML), and a specification of the security policy written in Alloy. The Alloy Analyzer tool is used to perform static analysis of the DM to automatically detect potential covert channel vulnerabilities and security policy violations in the target program.