Transforming out timing leaks
Top Cited Papers
- 5 January 2000
- proceedings article
- Published by Association for Computing Machinery (ACM)
Abstract
One aspect of security in mobile code is privacy: private (or secret) data should not be leaked to unauthorised agents. Most of the work on secure information flow has until recently only been concerned with detecting direct and indirect flows. Secret information can however be leaked to the attacker also through covert channels. It is very reasonable to assume that the attacker, even as an external observer, can monitor the timing (including termination) behaviour of the program. Thus to claim a program secure, the security analysis must take also these into account.In this work we present a surprisingly simple solution to the problem of detecting timing leakages to external observers. Our system consists of a type system in which well-typed programs do not leak secret information directly, indirectly or through timing, and a transformation for removing timing leakages. For any program that is well typed according to Volpano and Smith [VS97a], our transformation generates a program that is also free of timing leaks.Keywords
This publication has 10 references indexed in Scilit:
- JFlowPublished by Association for Computing Machinery (ACM) ,1999
- The SLam calculusPublished by Association for Computing Machinery (ACM) ,1998
- Secure information flow in a multi-threaded imperative languagePublished by Association for Computing Machinery (ACM) ,1998
- Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other SystemsPublished by Springer Nature ,1996
- Program specialization via program slicingPublished by Springer Nature ,1996
- Separating binding times in language specificationsPublished by Association for Computing Machinery (ACM) ,1989
- Predicative programming Part ICommunications of the ACM, 1984
- Security Policies and Security ModelsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1982
- Certification of programs for secure information flowCommunications of the ACM, 1977
- A lattice model of secure information flowCommunications of the ACM, 1976