Information Flow Control 

Controlling the flow of data in order to ensure its confidentiality by monitoring the shared data

Information Channels

  • Covert channels
  • Timing channels
  • Storage channels

 \n

Information Flow Control is considered impractical as a form of access control because it's extremely difficult to stop covert channel attacks

\

Data Labels

In order for information control flow to work, we need to label each piece of data to indicate permitted information flows

  • (ex: Where the data is from, where it's allowed to flow, etc.)

\ Data labelling specifies a set of policies:

Confidentiality Constraints

Who may read a given piece of data?

\

  • Label example: {Alice: Bob, Eve; Charlie: Bob, Eve}   * Alice and Charlie conjointly own a given set of data   * Bob and Eve are permitted to read it

\

Integrity Constraints

Who may modify a given piece of data?

\

  • Label Example: {Alice ? Bob}   * Alice owns the given set of data   * Bob is permitted to modify it

\

During Computation

During computation, an authorized entity can also rewrite part of the label

  • Example: Alice and Bob own a piece of data

 Rewriting Data Labels Example

  • Originally, Alice specified that Entity 1 (E1) and Entity 2 (E2) can access this data, meanwhile, Bob only specified Entity 2 (E2)
  • However, Bob wants to add Entity 3 (E3) to this list of entities that can read this data
  • In order to do so, Bob can rewrite his portion of the label

\ Labels can also get naturally propagated during computation

  • Example: If you perform some action where you reassign X to equal Y, then X's labels are thrown away and they get the labels of Y

\