Fable: A language for enforcing user-defined security policies Export

@inproceedings{citeulike:4921182, abstract = {This paper presents FABLE, a core formalism for a programming language in which programmers may specify security policies and reason that these policies are properly enforced. In FABLE, security policies can be expressed by associating security labels with the data or actions they protect. Programmers define the semantics of labels in a separate part of the program called the enforcement policy. FABLE prevents a policy from being circumvented by allowing labeled terms to be manipulated only within the enforcement policy; application code must treat labeled values abstractly. Together, these features facilitate straightforward proofs that programs implementing a particular policy achieve their high-level security goals. FABLE is flexible enough to implement a wide variety of security policies, including access control, information flow, provenance, and security automata. We have implemented FABLE as part of the LINKS web programming language; we call the resulting language SELINKS. We report on our experience using SELINKS to build two substantial applications, a wiki and an on-line store, equipped with a combination of access control and provenance policies. To our knowledge, no existing framework enables the enforcement of such a wide variety of security policies with an equally high level of assurance. 1}, author = {Swamy, Nikhil and Corcoran, Brian J. and Hicks, Michael}, booktitle = {In IEEE Symposium on Security and Privacy}, citeulike-article-id = {4921182}, citeulike-linkout-0 = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.9242}, keywords = {2008, enforcement, policy, security}, posted-at = {2009-06-22 09:54:31}, priority = {2}, title = {Fable: A language for enforcing user-defined security policies}, url = {http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.9242}, year = {2008} }

TY - CONF ID - citeulike:4921182 L3 - citeulike-article-id:4921182 N2 - This paper presents FABLE, a core formalism for a programming language in which programmers may specify security policies and reason that these policies are properly enforced. In FABLE, security policies can be expressed by associating security labels with the data or actions they protect. Programmers define the semantics of labels in a separate part of the program called the enforcement policy. FABLE prevents a policy from being circumvented by allowing labeled terms to be manipulated only within the enforcement policy; application code must treat labeled values abstractly. Together, these features facilitate straightforward proofs that programs implementing a particular policy achieve their high-level security goals. FABLE is flexible enough to implement a wide variety of security policies, including access control, information flow, provenance, and security automata. We have implemented FABLE as part of the LINKS web programming language; we call the resulting language SELINKS. We report on our experience using SELINKS to build two substantial applications, a wiki and an on-line store, equipped with a combination of access control and provenance policies. To our knowledge, no existing framework enables the enforcement of such a wide variety of security policies with an equally high level of assurance. 1 TI - Fable: A language for enforcing user-defined security policies T2 - In IEEE Symposium on Security and Privacy KW - 2008 KW - enforcement KW - policy KW - security AU - Swamy, Nikhil AU - Corcoran, Brian AU - Hicks, Michael PY - 2008/// UR - http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.114.9242 ER -