Liquid Information Flow Control
We present Lifty, a domain-specific language for data-centric applications that manipulate sensitive data. A Lifty programmer annotates the sources of sensitive data with declarative security policies, and the language statically and automatically verifies that the application handles the data according to the policies. Moreover, if verification fails, Lifty suggests a provably correct repair, thereby easing the programmer burden of implementing policy enforcing code throughout the application.
The main insight behind Lifty is to encode information flow control using liquid types, an expressive yet decidable type system. Liquid types enable fully automatic checking of complex, data dependent policies, and power our repair mechanism via type-driven error localization and patch synthesis. Our experience using Lifty to implement three case studies from the literature shows that (1) the Lifty policy language is sufficiently expressive to specify many real-world policies, (2) the Lifty type checker is able to verify secure programs and find leaks in insecure programs quickly, and (3) even if the programmer leaves out all policy enforcing code, the Lifty repair engine is able to patch all leaks automatically within a reasonable time.
Thu 21 OctDisplayed time zone: Central Time (US & Canada) change
10:50 - 12:10
|A General Approach to Define Binders using Matching Logic
Xiaohong Chen University of Illinois at Urbana-Champaign, Grigore Roşu University of Illinois at Urbana-ChampaignDOI
|Denotational Recurrence Extraction for Amortized Analysis
Joseph W. Cutler University of Pennsylvania, Daniel R. Licata Wesleyan University, Norman Danner Wesleyan UniversityDOI
|Program Sketching with Live Bidirectional Evaluation
Justin Lubin University of California at Berkeley, Nick Collins University of Chicago, Cyrus Omar University of Michigan, Ravi Chugh University of ChicagoDOI
|Liquid Information Flow Control
Nadia Polikarpova University of California at San Diego, Jean Yang Carnegie Mellon University, Deian Stefan University of California at San Diego, USA, Shachar Itzhaky Technion, Armando Solar-Lezama Massachusetts Institute of Technology, Travis Hance Carnegie Mellon UniversityDOI
|Discussion, Questions and Answers