LFP '92 Proceedings of the 1992 ACM conference on LISP and functional programming
Soft typing with conditional types
POPL '94 Proceedings of the 21st ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A syntactic approach to type soundness
Information and Computation
Type inference with constrained types
Theory and Practice of Object Systems - Special issue on foundations of object-oriented languages
A type system for expressive security policies
Proceedings of the 27th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Static enforcement of security with types
ICFP '00 Proceedings of the fifth ACM SIGPLAN international conference on Functional programming
Information flow inference for free
ICFP '00 Proceedings of the fifth ACM SIGPLAN international conference on Functional programming
The marriage of effects and monads
ACM Transactions on Computational Logic (TOCL)
A 3-Part Type Inference Engine
ESOP '00 Proceedings of the 9th European Symposium on Programming Languages and Systems
Enforcing Safety Properties Using Type Specialization
ESOP '01 Proceedings of the 10th European Symposium on Programming Languages and Systems
A new approach to mobile code security
A new approach to mobile code security
Enforcing Safety Properties Using Type Specialization
ESOP '01 Proceedings of the 10th European Symposium on Programming Languages and Systems
Java Bytecode Verification: An Overview
CAV '01 Proceedings of the 13th International Conference on Computer Aided Verification
Refinement types for secure implementations
ACM Transactions on Programming Languages and Systems (TOPLAS)
Verifying resource access control on mobile interactive devices
Journal of Computer Security - 7th International Workshop on Issues in the Theory of Security (WITS'07)
Automatic generation of history-based access control from information flow specification
ATVA'10 Proceedings of the 8th international conference on Automated technology for verification and analysis
Interprocedural analysis for privileged code placement and tainted variable detection
ECOOP'05 Proceedings of the 19th European conference on Object-Oriented Programming
A formal model of access control for mobile interactive devices
ESORICS'06 Proceedings of the 11th European conference on Research in Computer Security
| Hi-index | 0.00 |
The Java JDK 1.2 Security Architecture includes a dynamic mechanism for enforcing access control checks, so-called stack inspection. This paper studies type systems which can statically guarantee the success of these checks. We develop these systems using a new, systematic methodology: we show that the security-passing style translation, proposed by Wallach and Felten as a dynamic implementation technique, also gives rise to static security-aware type systems, by composition with conventional type systems. To define the latter, we use the general HM(X) framework, and easily construct several constraint- and unification-based type systems. They offer significant improvements on a previous type system for JDK access control, both in terms of expressiveness and in terms of readability of inferred type specifications.