JFlow: practical mostly-static information flow control
Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
SASI enforcement of security policies: a retrospective
Proceedings of the 1999 workshop on New security paradigms
SAFKASI: a security mechanism for language-based systems
ACM Transactions on Software Engineering and Methodology (TOSEM)
.NET framework security
Inside Java(TM) 2 Platform Security: Architecture, API Design, and Implementation
Inside Java(TM) 2 Platform Security: Architecture, API Design, and Implementation
ECOOP '01 Proceedings of the 15th European Conference on Object-Oriented Programming
IRM Enforcement of Java Stack Inspection
SP '00 Proceedings of the 2000 IEEE Symposium on Security and Privacy
Measuring the dynamic behaviour of AspectJ programs
OOPSLA '04 Proceedings of the 19th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
abc: an extensible AspectJ compiler
Proceedings of the 4th international conference on Aspect-oriented software development
Composing security policies with polymer
Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
Modular Software Design with Crosscutting Interfaces
IEEE Software
Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
How secure is AOP and what can we do about it?
Proceedings of the 2006 international workshop on Software engineering for secure systems
Beyond Stack Inspection: A Unified Access-Control and Information-Flow Security Model
SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
A Virtual Machine Based Information Flow Control System for Policy Enforcement
Electronic Notes in Theoretical Computer Science (ENTCS)
Proceedings of the 2nd Workshop on Virtual Machines and Intermediate Languages for emerging modularization mechanisms
Proceedings of the 8th ACM international conference on Aspect-oriented software development
Laminar: practical fine-grained decentralized information flow control
Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation
Efficient purely-dynamic information flow analysis
Proceedings of the ACM SIGPLAN Fourth Workshop on Programming Languages and Analysis for Security
The design of the force.com multitenant internet application development platform
Proceedings of the 2009 ACM SIGMOD International Conference on Management of data
Open modules: modular reasoning about advice
ECOOP'05 Proceedings of the 19th European conference on Object-Oriented Programming
Inspection of distributed and composed systems
Proceedings of the 8th Middleware Doctoral Symposium
Secure and modular access control with aspects
Proceedings of the 12th annual international conference on Aspect-oriented software development
| Hi-index | 0.00 |
The integration of third-party aspects into applications creates security challenges. Due to the intrusive impact of aspects, one cannot guarantee that the dynamic composition of aspects does not lead to misbehavior. The newly composed aspect typically has many, if not unrestricted, rights to read and modify attributes of the base system. AspectJ, amongst other AOP systems, suffers from this limitation, which makes the composition of independently developed aspects riskful. We have defined and prototyped a run-time policy enforcement model based on execution history to protect programs from untrusted aspects. The dynamic nature of the approach has the advantage that up to date run-time information allows more accurate decision making. We have built a prototype for AspectJ and illustrate its use in a realistic example. Our evaluation shows that practical use of such a solution is feasible and that run-time overhead can be limited.