An Information Flow Security Based on Protected Area in eCommerce

다국어 초록 (Multilingual Abstract)

Confidentiality is one of the most important requirements of information protection systems. The access control technique has been used to provide confidentiality, but it has fundamental problems in that it cannot prevent violations of confidentiality committed by authorized users. Information flow control is a technique introduced to resolve such problems, and many approaches based on programming languages have been proposed. However, it is not easy for a programmer to implement the technique at the source code level. Furthermore, the practicality of information flow control is difficult to demonstrate because it does not provide control over programs that have already been developed. This paper proposes a method that enables a practical information flow control through using a protected area, a separate part of computer system storage. Case studies are given to show its usefulness.

참고문헌 (Reference)

1 "http://www.cs.cornell.edu/jif/."

2 "http://cristal.inria.fr/～simonet/soft/flowcaml/."

3 N. Heintze, "The SLam calculus：Programming with secrecy and integrity" 365-377, 1998

4 S. Tse, "Run-time Principals inInformation-flow Type Systems" 2004

5 R. S. Sandhu, "Role-Based Access Control Models" 29 (29): 38-47, 1996

6 D. F. Ferraiolo, "Role-Based Access Control" Artech House 2003

7 S. Zdancewic, "Robust declassification" 15-23, 2001

8 N. Vachharajani, "Rifle：An architectural framework for usercentric information-flow security" 2004

9 Eunyoung Lee, "Programming Languagebased Information Flow Security" 16 (16): 35-44, 2006

10 A. Sabelfeld, "Language- Based Information-Flow Security" 21 : 5-19, 2003

11 A. C. Myers, "JFlow：Practical mostlystatic information flow control" 228-241, 1999

12 Clark, C. Hankin, "Information flow for algol-like languages" 2002

13 G. V. Posta, "Evaluating information security tradeoffs：Restricting access can interfere with user tasks" 26 (26): 229-237, 2007

14 L. Zheng and, "Dynamic security labels and noninterference" 2004

15 U. S. Department of Defense, "Department of Defense Trusted Computer System Evaluation Criteria" National Computer Security Center 1985

16 S. Zdancewic, "Challenges for informationflow security" 2004

17 D. E. Denning, "Certification of programs for secure information flow" 20 (20): 504-513, 1977

18 Seungcheol Shin, "Analyzing Methods for Information Flow Security" 16 (16): 55-64, 2006

19 A. C. Myers, "A decentralized model for information flow control" 129-142, 1997

20 Abadi, "A calculus for cryptographic protocols：The Spi calculus" 148 (148): 1-70, 1999