@inproceedings{87f1cf30812749b0b4e93bc6c2458ba6,
title = "Using access control for secure information flow in a Java-like language",
abstract = "Access control mechanisms are widely used with the intent of enforcing confidentiality and other policies, but few formal connections have been made between information flow and access control. Java and C\# are object-oriented languages that provide fine-grained access control. An access control list specifies local policy by authorizing permissions for principals (code sources) associated with class declarations; a mechanism called stack inspection checks permissions at run time. An example is given to show how this mechanism can be used to achieve confidentiality goals in situations where a single system call serves callers of differing confidentiality levels and dynamic access control prevents release of high information to low callers. A static analysis is given which applies to such examples. The analysis is shown to ensure a noninterference property formalizing confidentiality.",
keywords = "Access control, Authorization, Computer science, Computer security, Engineering profession, Information analysis, Information security, Inspection, Java, Permission",
author = "A. Banerjee and Naumann, \{D. A.\}",
note = "Publisher Copyright: {\textcopyright} 2003 IEEE.; 16th IEEE Computer Security Foundations Workshop, CSFW 2003 ; Conference date: 30-06-2003 Through 02-07-2003",
year = "2003",
doi = "10.1109/CSFW.2003.1212711",
language = "English",
series = "Proceedings of the Computer Security Foundations Workshop",
pages = "155--169",
booktitle = "Proceedings - 16th IEEE Computer Security Foundations Workshop, CSFW 2003",
}