Adding type parameterization to the Java language
Proceedings of the 12th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Enforcing trace properties by program transformation
Proceedings of the 27th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
ACM Transactions on Information and System Security (TISSEC)
Stack inspection: theory and variants
POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Java Virtual Machine Specification
Java Virtual Machine Specification
Pointcuts and advice in higher-order languages
Proceedings of the 2nd international conference on Aspect-oriented software development
ECOOP '01 Proceedings of the 15th European Conference on Object-Oriented Programming
Mechanisms for secure modular programming in Java
Software—Practice & Experience - Special issue: Security software
IRM Enforcement of Java Stack Inspection
SP '00 Proceedings of the 2000 IEEE Symposium on Security and Privacy
ICFP '03 Proceedings of the eighth ACM SIGPLAN international conference on Functional programming
PolyAML: a polymorphic aspect-oriented functional programming language
Proceedings of the tenth ACM SIGPLAN international conference on Functional programming
Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Certified In-lined Reference Monitoring on .NET
Proceedings of the 2006 workshop on Programming languages and analysis for security
JavaScript instrumentation for browser security
Proceedings of the 34th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A type-theoretic interpretation of pointcuts and advice
Science of Computer Programming - Special issue: Foundations of aspect-oriented programming
Specifying and analyzing security automata using CSP-OZ
ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
Decentralized enforcement of security policies for distributed computational systems
Proceedings of the 2007 ACM symposium on Applied computing
Mining Security-Sensitive Operations in Legacy Code Using Concept Analysis
ICSE '07 Proceedings of the 29th international conference on Software Engineering
Supporting Security Monitor-Aware Development
SESS '07 Proceedings of the Third International Workshop on Software Engineering for Secure Systems
Rewriting-Based Access Control Policies
Electronic Notes in Theoretical Computer Science (ENTCS)
Weaving rewrite-based access control policies
Proceedings of the 2007 ACM workshop on Formal methods in security engineering
A flexible security architecture to support third-party applications on mobile devices
Proceedings of the 2007 ACM workshop on Computer security architecture
A compact aspect-based security monitor for J2ME applications
CompSysTech '07 Proceedings of the 2007 international conference on Computer systems and technologies
Execution monitoring enforcement under memory-limitation constraints
Information and Computation
AspectML: A polymorphic aspect-oriented functional programming language
ACM Transactions on Programming Languages and Systems (TOPLAS)
Security-by-contract on the .NET platform
Information Security Tech. Report
Simulating midlet's security claims with automata modulo theory
Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security
Aspect-oriented in-lined reference monitors
Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security
Provably Correct Runtime Monitoring
FM '08 Proceedings of the 15th international symposium on Formal Methods
A Caller-Side Inline Reference Monitor for an Object-Oriented Intermediate Language
FMOODS '08 Proceedings of the 10th IFIP WG 6.1 international conference on Formal Methods for Open Object-Based Distributed Systems
On Practical Information Flow Policies for Java-Enabled Multiapplication Smart Cards
CARDIS '08 Proceedings of the 8th IFIP WG 8.8/11.2 international conference on Smart Card Research and Advanced Applications
Monitoring the Execution of Third-Party Software on Mobile Devices
RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Run-Time Enforcement of Nonsafety Policies
ACM Transactions on Information and System Security (TISSEC)
ConSpec – A formal language for policy specification
Science of Computer Programming
Execution monitoring enforcement for limited-memory systems
Proceedings of the 2006 International Conference on Privacy, Security and Trust: Bridge the Gap Between PST Technologies and Business Services
Composing expressive runtime security policies
ACM Transactions on Software Engineering and Methodology (TOSEM)
Lightweight self-protecting JavaScript
Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
Trustworthy Global Computing
Do You Really Mean What You Actually Enforced?
Formal Aspects in Security and Trust
Security enforcement aware software development
Information and Software Technology
Access control policy combining: theory meets practice
Proceedings of the 14th ACM symposium on Access control models and technologies
Local policies for resource usage analysis
ACM Transactions on Programming Languages and Systems (TOPLAS)
Control-flow integrity principles, implementations, and applications
ACM Transactions on Information and System Security (TISSEC)
Security Monitor Inlining for Multithreaded Java
Genoa Proceedings of the 23rd European Conference on ECOOP 2009 --- Object-Oriented Programming
Handling inheritance violation for secure interoperation of heterogeneous systems
International Journal of Security and Networks
Improving application security with data flow assertions
Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles
Enforcing IRM security policies: two case studies
ISI'09 Proceedings of the 2009 IEEE international conference on Intelligence and security informatics
Experiences with embedding MPL security monitors into Java programs
CompSysTech '09 Proceedings of the International Conference on Computer Systems and Technologies and Workshop for PhD Students in Computing
Provably correct inline monitoring for multithreaded Java-like programs
Journal of Computer Security - EU-Funded ICT Research on Trust and Security
A permission system for secure AOP
Proceedings of the 9th International Conference on Aspect-Oriented Software Development
Visualization of permission checks in java using static analysis
WISA'06 Proceedings of the 7th international conference on Information security applications: PartI
A flexible architecture for enforcing and composing policies in a service-oriented environment
DAIS'07 Proceedings of the 7th IFIP WG 6.1 international conference on Distributed applications and interoperable systems
On run-time enforcement of policies
ASIAN'07 Proceedings of the 12th Asian computing science conference on Advances in computer science: computer and network security
Synthesising monitors from high-level policies for the safe execution of untrusted software
ISPEC'08 Proceedings of the 4th international conference on Information security practice and experience
Enhancing Java security with history based access control
Foundations of security analysis and design IV
Proceedings of the 2010 ICSE Workshop on Software Engineering for Secure Systems
Component-based security policy design with colored Petri nets
Semantics and algebraic specification
FIRM: capability-based inline mediation of Flash behaviors
Proceedings of the 26th Annual Computer Security Applications Conference
Flexible in-lined reference monitor certification: challenges and future directions
Proceedings of the 5th ACM workshop on Programming languages meets program verification
Access control via belnap logic: Intuitive, expressive, and analyzable policy composition
ACM Transactions on Information and System Security (TISSEC)
Engineering secure future internet services
The future internet
Transactions on computational science XI
Combining static analysis and runtime checking in security aspects for distributed tuple spaces
COORDINATION'11 Proceedings of the 13th international conference on Coordination models and languages
Security-typed languages for implementation of cryptographic protocols: a case study
ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security
Enforcing non-safety security policies with program monitors
ESORICS'05 Proceedings of the 10th European conference on Research in Computer Security
Security-policy monitoring and enforcement with JavaMOP
Proceedings of the 7th Workshop on Programming Languages and Analysis for Security
Enhancing javascript with transactions
ECOOP'12 Proceedings of the 26th European conference on Object-Oriented Programming
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code
Proceedings of the 2012 ACM conference on Computer and communications security
Usage control in service-oriented architectures
TrustBus'07 Proceedings of the 4th international conference on Trust, Privacy and Security in Digital Business
Modular access control via strategic rewriting
ESORICS'07 Proceedings of the 12th European conference on Research in Computer Security
The need for capability policies
Proceedings of the 15th Workshop on Formal Techniques for Java-like Programs
Control-flow integrity principles, implementations, and applications
ACM Transactions on Information and System Security (TISSEC)
Hi-index | 0.00 |
We introduce a language and system that supports definition and composition of complex run-time security policies for Java applications. Our policies are comprised of two sorts of methods. The first is query methods that are called whenever an untrusted application tries to execute a security-sensitive action. A query method returns a suggestion indicating how the security-sensitive action should be handled. The second sort of methods are those that perform state updates as the policy's suggestions are followed.The structure of our policies facilitates composition, as policies can query other policies for suggestions. In order to give programmers control over policy composition, we have designed the system so that policies, suggestions, and application events are all first-class objects that a higher-order policy may manipulate. We show how to use these programming features by developing a library of policy combinators.Our system is fully implemented, and we have defined a formal semantics for an idealized subset of the language containing all of the key features. We demonstrate the effectiveness of our system by implementing a large-scale security policy for an email client.