Protecting privacy using the decentralized label model

TLDR

Strong protection is needed for data confidentiality and integrity because untrusted code is common, yet information flow control, though enabling end‑to‑end security policies, has been hard to implement. The article introduces the decentralized label model and its Java extension Jif to control information flow in mutually distrustful, decentralized systems. The model supports static program analysis of information flow, permitting certification of acceptable flows while avoiding run‑time checking overhead. The model improves multilevel security by enabling decentralized declassification and finer‑grained data sharing.

Abstract

Stronger protection is needed for the confidentiality and integrity of data, because programs containing untrusted code are the rule rather than the exception. Information flow control allows the enforcement of end-to-end security policies, but has been difficult to put into practice. This article describes the decentralized label model, a new label model for control of information flow in systems with mutual distrust and decentralized authority. The model improves on existing multilevel security models by allowing users to declassify information in a decentralized way, and by improving support for fine-grained data sharing. It supports static program analysis of information flow, so that programs can be certified to permit only acceptable information flows, while largely avoiding the overhead of run-time checking. The article introduces the language Jif, an extension to Java that provides static checking of information flow using the decentralized label model.