Dynamic Information Flow Control Architecture for Web Applications

@incollection{citeulike:1679260, abstract = {In typical Web applications, the access control at the database management system is not effective due to the dependency on application behavior. That is, once the information is retrieved, a careless application can easily leak the information to undesirable parties. In addition, database accounts are often shared for multiple Web users in order to allow connection pooling. We propose DIFCA-J (Dynamic Information Flow Control Architecture for Java), to keep track of and control fine-grained information propagation through execution of the program. DIFCA-J allows controlling the information flow at run-time, without needing to modify the source code of the target application or the Java VMs.}, author = {Yoshihama, Sachiko and Yoshizawa, Takeo and Watanabe, Yuji and Kudoh, Michiharu and Oyanagi, Kazuko}, citeulike-article-id = {1679260}, doi = {10.1007/978-3-540-74835-9_18}, journal = {Computer Security – ESORICS 2007}, keywords = {information\_flow}, pages = {267--282}, posted-at = {2007-09-20 15:55:01}, priority = {2}, title = {Dynamic Information Flow Control Architecture for Web Applications}, url = {http://dx.doi.org/10.1007/978-3-540-74835-9_18}, year = {2007} }

TY - CHAP ID - citeulike:1679260 L3 - citeulike-article-id:1679260 N2 - In typical Web applications, the access control at the database management system is not effective due to the dependency on application behavior. That is, once the information is retrieved, a careless application can easily leak the information to undesirable parties. In addition, database accounts are often shared for multiple Web users in order to allow connection pooling. We propose DIFCA-J (Dynamic Information Flow Control Architecture for Java), to keep track of and control fine-grained information propagation through execution of the program. DIFCA-J allows controlling the information flow at run-time, without needing to modify the source code of the target application or the Java VMs. JF - Computer Security – ESORICS 2007 EP - 282 TI - Dynamic Information Flow Control Architecture for Web Applications SP - 267 KW - information_flow AU - Yoshihama, Sachiko AU - Yoshizawa, Takeo AU - Watanabe, Yuji AU - Kudoh, Michiharu AU - Oyanagi, Kazuko PY - 2007/// UR - http://dx.doi.org/10.1007/978-3-540-74835-9_18 ER -