정보보호학회지 (Review of KIISC)

한국정보보호학회 (Korea Institute of Information Security and Cryptology)
권호 표지

프로그래밍 언어에 기반한 정보흐름 보안

  • 이은영 (동덕여자대학교 정보과학대학 컴퓨터학과)
  • 발행 : 2006.10.30
PDF 다운로드
⟨ 이전 논문 다음 논문 ⟩

초록

컴퓨터가 다루고 있는 정보의 기밀성(confidentiality of information)을 보호하는 일은 매우 중요하며, 그 중요성은 날이 갈수록 증가하고 있다. 그럼에도 불구하고, 실제로 정보의 기밀성과 무결성(integrity)을 완벽하게 보호해 주는 컴퓨터 시스템은 매우 찾기가 어렵다는 것이 또한 알려진 사실이다. 기존에 존재하는 이론적인 프레임워크들은 기밀성을 표현하기에는 부적절하며, 기밀성 보호를 위한 실제적인 시스템들 역시 이론적인 면에서 충분히 만족스럽지 못하다. 이와 같은 현실에서 타입시스템을 가지는 프로그래밍 언어가 정보 기밀성 보호를 위한 효과적인 방법으로 새로운 관심을 받고 있으며, 상당한 연구가 이 방향으로 진행되고 있다. 본 논문에서는 이제까지 진행되었던 연구들을 중심으로 프로그래밍 언어를 이용한 정보 기밀성 보호의 연구 동향과 주요 과제들을 소개하고자 한다.

키워드

참고문헌

  1. J. Palsberg and P. Orbæk, 'Trust in the ${\lambda}-calculus$,' in Proc. Symposium on Static Analysis. Sept. 1995, number 983 in LNCS, pp. 314-329, Springer-Verlag
  2. D. Volpano, G. Smith, and C. Irvine, 'A sound type system for secure flow analysis,' J. Computer Security, vol. 4, no. 3, pp. 167-187, 1996 https://doi.org/10.3233/JCS-1996-42-304
  3. A. C. Myers and B. Liskov, 'A decentralized model for information flow control,' in Proc. ACM Symp. on Operating System Principles, Oct. 1997, pp. 129-142
  4. N. Heintze and J. G. Riecke, 'The SLam calculus: programming with secrecy and integrity,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 1998, pp. 365-377
  5. G. Smith and D. Volpano, 'Secure information flow in a multithreaded imperative language,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 1998, pp. 355-364
  6. A. C. Myers, 'JFlow: Practical mostlystatic information flow control,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 1999, pp. 228-241
  7. G. Barthe and B. Serpette, 'Partial evaluation and non-interference for object calculi,' in Proc. FLOPS. Nov. 1999, vol. 1722 of LNCS, pp. 53-67, Springer-Verlag
  8. D. Volpano and G. Smith, 'Probabilistic noninterference in a concurrent language,' J. Computer Security, vol. 7, no. 2-3, pp. 231-253, Nov. 1999 https://doi.org/10.3233/JCS-1999-72-305
  9. J. Agat, 'Transforming out timing leaks,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 2000, pp. 40-53
  10. A. Sabelfeld and D. Sands, 'Probabilistic noninterference for multithreaded programs,' in Proc. IEEE Computer Security Foundations Workshop, July 2000, pp. 200-214
  11. S. Zdancewic and A. C. Myers, 'Secure information flow and CPS,' in Proc. European Symposium on Programming. Apr. 2001, vol. 2028 of LNCS, pp. 46-61, Springer-Verlag
  12. A. Banerjee and D. A. Naumann, 'Secure information flow and pointer confinement in a Java-like language,' in Proc. IEEE Computer Security Foundations Workshop, June 2002, pp. 253-267
  13. F. Pottier and V. Simonet, 'Information flow inference for ML,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 2002, pp. 319-330
  14. Andrei Sabelfeld and Andrew C. Myers. Language-based informationflow security. IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, 21(1), 2003
  15. R. Wahbe, S. Lucco, T. Anderson, and S. Graham, 'Efficient softwarebased fault isolation,' in Proc. ACM Symp. on Operating System Principles, Dec. 1993, pp. 203-216
  16. G. Morrisett, D. Walker, K. Crary, and N. Glew, 'From System F to typed assembly language,' ACM TOPLAS, vol. 21, no. 3, pp. 528-569, May 1999
  17. D. Wagner, Static analysis and computer security: New techniques for software assurance, Ph.D. thesis, University of California at Berkeley, 2000
  18. G. C. Necula, 'Proof-carrying code,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 1997, pp. 106-119
  19. U. Erlingsson and F. B. Schneider, 'SASI enforcement of security policies: A retrospective,' in Proc. of the New Security Paradigm Workshop, Sept. 1999, pp. 87-95
  20. D. Evans and A. Twyman, 'Flexible policy-directed code safety,' in Proc. IEEE Symp. on Security and Privacy, May 1999, pp. 32-45
  21. F. B. Schneider, G. Morrisett, and R. Harper, 'A language-based approach to security,' in Informatics-10 Years Back, 10 Years Ahead, vol. 2000 of LNCS, pp. 86-101. Springer-Verlag, 2000
  22. Department of Defense, Department of Defense Trusted Computer System Evaluation Criteria, DOD 5200.28-STD (The Orange Book) edition, Dec. 1985
  23. J. H. Saltzer and M. D. Schroeder, 'The protection of information in computer systems,' Proc. of the IEEE, vol. 63, no. 9, pp. 1278-1308, Sept. 1975 https://doi.org/10.1109/PROC.1975.9939
  24. M. A. Sheldon and D. K. Gifford, 'Static dependent types for first class modules,' in Proc. Lisp and Functional Programming, June 1990, pp. 20-29
  25. H. Xi and F. Pfenning, 'Dependent types in practical programming,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 1999, pp. 214-227
  26. F. Nielson, H. Riis Nielson, and C. Hankin, Principles of Program Analysis, Springer-Verlag, 1999
  27. D. E. Denning and P. J. Denning, 'Certification of programs for secure information flow,' Comm. of the ACM, vol. 20, no. 7, pp. 504-513, July 1977 https://doi.org/10.1145/359636.359712
  28. M. Abadi and A. D. Gordon, 'A calculus for cryptographic protocols: The Spi calculus,' Information and Computation, vol. 148, no. 1, pp. 1-70, Jan. 1999 https://doi.org/10.1006/inco.1998.2740
  29. S. Zdancewic and A. C. Myers, 'Robust declassification,' in Proc. IEEE Computer Security Foundations Workshop, June 2001, pp. 15-23
  30. C. Bodei, P. Degano, F. Nielson, and H. Riis Nielson, 'Static analysis of processes for no read-up and no write-down,' in Proc. Foundations of Software Science and Computation Structure. Apr. 1999, number 1578 in LNCS, pp. 120-134, Springer-Verlag
  31. F. Nielson, H. Riis Nielson, R. R. Hansen, and J. G. Jensen, 'Validating firewalls in mobile ambients,' in Proc. CONCUR'99. 1999, number 1664 in LNCS, pp. 463-477, Springer-Verlag
  32. D. Volpano and G. Smith, 'Verifying secrets and relative secrecy,' in Proc. ACM Symp. on Principles of Programming Languages, Jan. 2000, pp. 268-276
  33. A. W. Appel, 'Foundational Proof-Carrying Code,' in 16th Annual IEEE Symposium on Logic in Computer Science (LICS '01), pp. 247-258, June 2001
  34. D. Clark, C. Hankin, and S. Hunt, 'Information flow for Algol-like languages,' Journal of Computer Languages, 2002