Implicit flows in malicious and nonmalicious code

Information-flow technology is a promising approach for ensuring securityby design and construction. When tracking information flow, of particular concernare implicit flows, i.e., flows through control flow when computation brancheson secret data and performs publicly observed side effects depending on whichbranch is taken.The large body of literature exercises two extreme views on implicit flows: eithertrack them (striving to show that there are no leaks, and often running into theproblem of complex enforcement mechanisms and false alarms), or not track them(which reduces false alarms, but provides weak or no security guarantees).This paper distinguishes between malicious and nonmalicious code. The attackermay exploit implicit flows with malicious code, and so they should be tracked. Weshow how this can be done by a security type system and by a monitor. For nonmaliciouscode, we explore a middle ground between the two extremes.We observe thatimplicit flows are often harmless in nonmalicious code: they cannot be exploitedto efficiently leak secrets. To this end, we are able to guarantee strong informationflowproperties with a combination of an explicit-flow and a graph-pattern analyses.Initial studies of industrial code (secure logging and data sanitization) suggestthat our approach has potential of offering a desired combination of a lightweightanalysis, strong security guarantees, and no excessive false alarms