JFlow

TLDR

Static information‑flow checking protects privacy and integrity, but prior language extensions are too restrictive and unimplemented. The paper introduces JFlow, a Java extension with statically‑checked information‑flow annotations, and formally defines its language and checking rules. JFlow implements a decentralized label model, label polymorphism, run‑time checking, automatic inference, and supports objects, subclassing, dynamic type tests, access control, and exceptions. Because most checking is static, JFlow incurs minimal code, data, or run‑time overhead.

Abstract

A promising technique for protecting privacy and integrity of sensitive data is to statically check information flow within programs that manipulate the data. While previous work has proposed programming language extensions to allow this static checking, the resulting languages are too restrictive for practical use and have not been implemented. In this paper, we describe the new language JFlow, an extension to the Java language that adds statically-checked information flow annotations. JFlow provides several new features that make information flow checking more flexible and convenient than in previous models: a decentralized label model, label polymorphism, run-time label checking, and automatic label inference. JFlow also supports many language features that have never been integrated successfully with static information flow control, including objects, subclassing, dynamic type tests, access control, and exceptions. This paper defines the JFlow language and presents formal rules that are used to check JFlow programs for correctness. Because most checking is static, there is little code space, data space, or run-time overhead in the JFlow implementation.