Tracking Dependencies for Security and Privacy

Information Flow Control is a well established field of research, providing asuite of theoretical and practical results. However, adoption to real worldsystems has yet to catch up. This thesis seeks to expand the boundaries ofthis field, in particular with the aim of making Information Flow Control moreapplicable to real world scenarios. To this end, it studies several areas forimprovement. These range from fundamental notions of policies for specifyinglimitations on data dependencies induced by programs, to mechanisms forenforcing such policies both statically and dynamically. We aim to push thecurrent state of the art by identifying and addressing areas where currentpolicy definitions and enforcement mechanisms fall short in terms of providinginformation confidentiality and integrity. On the policy side, we examine existing, incomparable notions of integrity. Wepresent a generalized integrity framework that features a range of integrityfacets including correctness to data dependency. We demonstrate how all thefacets at once can be enforced by a single execution monitor. We also considerinformation leaked in multiple runs, which traditional non-interferencepolicies address poorly. Employing a knowledge-based policy, we show that onlyminor adjustments are needed to standard type systems to cover the multi-runcase. We apply data-dependency policies and tracking to provide a flexibleprogramming model on top of differentially private databases. On the enforcement side, we demonstrate how a language endowed withcapabilities can directly enforce information flow control policies using suchprimitives, through a program transformation. The thesis then considers thepermissiveness of dynamic monitors, and shows that it can be improvedmechanically through the use of random testing and program rewriting.Following that, we explore the challenges, and their solutions, of implementinga dynamic monitor for the full language of JavaScript, including its built-inlibraries and APIs.Finally, we develop a framework of integrity-protected capabilities thatsupport attenuated delegation and contextual bindings. In particular,contextual bindings allow the capability to encode dependencies between theinvokers context, the resource it refers to and the hosts context, that must besatisfied for proper authorization. We show that our construction applies wellto cheap but powerful authentication protocols for distributed systems andcloud services