@inproceedings{87f1cf30812749b0b4e93bc6c2458ba6,
title = "Using access control for secure information flow in a Java-like language",
abstract = "Access control mechanisms are widely used with the intent of enforcing confidentiality and other policies, but few formal connections have been made between information flow and access control. Java and C# are object-oriented languages that provide fine-grained access control. An access control list specifies local policy by authorizing permissions for principals (code sources) associated with class declarations; a mechanism called stack inspection checks permissions at run time. An example is given to show how this mechanism can be used to achieve confidentiality goals in situations where a single system call serves callers of differing confidentiality levels and dynamic access control prevents release of high information to low callers. A static analysis is given which applies to such examples. The analysis is shown to ensure a noninterference property formalizing confidentiality.",
keywords = "Access control, Authorization, Computer science, Computer security, Engineering profession, Information analysis, Information security, Inspection, Java, Permission",
author = "A. Banerjee and Naumann, {D. A.}",
note = "Publisher Copyright: {\textcopyright} 2003 IEEE.; 16th IEEE Computer Security Foundations Workshop, CSFW 2003 ; Conference date: 30-06-2003 Through 02-07-2003",
year = "2003",
doi = "10.1109/CSFW.2003.1212711",
language = "English",
series = "Proceedings of the Computer Security Foundations Workshop",
pages = "155--169",
booktitle = "Proceedings - 16th IEEE Computer Security Foundations Workshop, CSFW 2003",
}