The dissertation deals with language-based security and tries to answer the following question: how to protect the host system that executes mobile programs, like applets? As mobile programs are potentially malicious, the host system must ensure that their execution is not dangerous for its resources. A solution is to execute mobile programs in a secured environment: the environment enables the information flows between mobile programs and local resources and the accesses from mobile programs to local resources, to be controlled. We give two security criteria for securely executing mobile code. The first one deals with information flows, ensures confidentiality, is based on the code of the local environment, is accurate and undecidable; the second one deals with access controls, ensures confinement, is based on the type of the local environment, is approximate and decidable.
Mobile programs, like applets, are not only ubiquitous but also potentially malicious. We study the case where mobile programs are executed by a host system in a secured environment, in order to control the accesses from mobile programs to local resources. The article deals with the following question: how can we ensure that the local environment is secure? We answer by giving a confinement criterion: if the type of the local environment satisfies it, then no mobile program can directly access a local resource. The criterion, which is type-based and hence decidable, is valid for a functional language with references. By proving its validity, we solve a conjecture stated by Leroy and Rouaix at POPL ’98. Moreover, we show that the criterion cannot be weakened by giving counter-examples for all the environment types that do not satisfy the criterion, and that it is pertinent by detailing the example of a specific security architecture. The main contribution of the article is the proof method, based on a language annotation that keeps track of code origin and that enables the study of the interaction frontier between the local code and the mobile code. The generalization of the method is finally discussed.
With Xavier Leroy, Information and Computation, Special issue on Structural Operational Semantics (SOS), 2009.
We propose a method to characterize the fixed points described in Tarski’s theorem for complete lattices. The method is deductive: the least and greatest fixed points are "proved" in some inference system defined from deduction rules. We also apply the method to two other fixed point theorems, a generalization of Tarski’s theorem to chain-complete posets and Bourbaki-Witt’s theorem. Finally, we compare the method with the traditional iterative method resorting to ordinals and the original impredicative method used by Tarski.
Nowadays, services are more and more implemented by using object-oriented frameworks. In this context, two properties could be particularly required in the specification of these frameworks: (i) a loose coupling between the service layer and the object layer, allowing evolution of the service layer with a minimal impact on the object layer, (ii) an interoperability induced by the substitution principle associated to subtyping in the object layer, allowing to freely convert a value of a subtype into a supertype. However, experimenting with the popular cxf framework, we observed some undesirable coupling and interoperability issues, due to the failure of the substitution principle. Therefore we propose a new specification of the data binding used to translate data between the object and service layers. We show that if the cxf framework followed the specification, then the substitution principle would be recovered, with all its advantages.
Last Updated 2015-04-17T08:45+0200. Comments or questions: Send a mail.