Policies and proofs for code auditing

Authors:
Nathan Whitehead;Jordan Johnson;Martín Abadi
Affiliations:
University of California, Santa Cruz;University of California, Santa Cruz;University of California, Santa Cruz and Microsoft Research
Venue:
ATVA'07 Proceedings of the 5th international conference on Automated technology for verification and analysis
Year:
2007

Citing 14
Cited 0

The calculus of constructions

Information and Computation - Semantics of Data Types
A framework for defining logics

Journal of the ACM (JACM)
Authentication in distributed systems: theory and practice

ACM Transactions on Computer Systems (TOCS)
A calculus for access control in distributed systems

ACM Transactions on Programming Languages and Systems (TOPLAS)
Proof-carrying code

Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
From system F to typed assembly language

ACM Transactions on Programming Languages and Systems (TOPLAS)
Java Virtual Machine Specification

Java Virtual Machine Specification
Binder, a Logic-Based Security Language

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Trust in the λ-calculus

Journal of Functional Programming
Interactive Theorem Proving and Program Development

Interactive Theorem Proving and Program Development
By Reason and Authority: A System for Authorization of Proof-Carrying Code

CSFW '04 Proceedings of the 17th IEEE workshop on Computer Security Foundations
Dimensions and Principles of Declassification

CSFW '05 Proceedings of the 18th IEEE workshop on Computer Security Foundations
A certified distributed security logic for authorizing code

TYPES'06 Proceedings of the 2006 international conference on Types for proofs and programs
Language-based information-flow security

IEEE Journal on Selected Areas in Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Both proofs and trust relations play a role in security decisions, in particular in determining whether to execute a piece of code. We have developed a language, called BCIC, for policies that combine proofs and trusted assertions about code. In this paper, using BCIC, we suggest an approach to code auditing that bases auditing decisions on logical policies and tools.