论文标题
透明的IFC执行：可能性和（IN）效率结果
Transparent IFC Enforcement: Possibility and (In)Efficiency Results
论文作者
论文摘要
信息流控制（IFC）是用于确保无编写的无读样式安全策略的技术集合，称为非干预。用于静态和动态IFC的传统方法都遭受了现实世界中的大量错误警报。安全的多执行（SME）有望提供安全的IFC，而无需修改已被称为透明度的属性的行为。 SME的实现存在于Web，并作为几种编程语言的插件。此外，从理论上讲，中小型企业可以以黑盒方式工作，这意味着它可以是编程语言不可知论，使其非常适合确保遗产或第三方系统。因此，对于安全工程师来说，SME及其变体（例如多个方面（MF）（MF）和式安全多执行（FSME）似乎是Panaceas的家族。问题是，考虑到所有这些优势，这些技术在实践中并不普遍存在？答案部分在于运行时和内存开销问题。在许多非平凡情况下，SME及其变体的部署非常昂贵。为什么这样？从表面上看，原因很简单。中小企业家族中的技术都依赖于多执行，多次运行程序的所有或部分以实现非干预的想法。自然，这会导致开销。但是，IFC社区的目标是克服这些间接费用。在本文中，我们认为有根本原因可以期望这是不可能的，并证明了两个关键定理：1。所有透明执行都是多项式时间等同于多执行的时间。 2。所有黑框执法都需要在安全晶格中的主体数量中达到时间指数。我们还以肯定的方式回答了一个关于透明执行Tini安全状况的可能性的公开问题。
Information Flow Control (IFC) is a collection of techniques for ensuring a no-write-down no-read-up style security policy known as noninterference. Traditional methods for both static and dynamic IFC suffer from untenable numbers of false alarms on real-world programs. Secure Multi-Execution (SME) promises to provide secure IFC without modifying the behaviour of already secure programs, a property known as transparency. Implementations of SME exist for the web and as plug-ins to several programming languages. Furthermore, SME can in theory work in a black-box manner, meaning that it can be programming language agnostic, making it perfect for securing legacy or third-party systems. As such SME, and its variants like Multiple Facets (MF) and Faceted Secure Multi-Execution (FSME), appear to be a family of panaceas for the security engineer. The question is, how come, given all these advantages, that these techniques are not ubiquitous in practice? The answer lies, partially, in the issue of runtime and memory overhead. SME and its variants are prohibitively expensive to deploy in many non-trivial situations. Why is this the case? On the surface, the reason is simple. The techniques in the SME family all rely on the idea of multi-execution, running all or parts of a program multiple times to achieve noninterference. Naturally, this causes overhead. However, the goal in the IFC community has been to overcome these overheads. In this paper we argue that there are fundamental reasons to expect this not to be possible and prove two key theorems: 1. All transparent enforcement is polynomial time equivalent to multi-execution. 2. All black-box enforcement takes time exponential in the number of principals in the security lattice. We also answer, in the affirmative, an open question about the possibility of transparently enforcing the TINI security condition.
