Skip to main content
SpringerLink
Log in

A Haskell-Embedded DSL for Secure Information-Flow

  • Conference paper
  • First Online:
Formal Methods: Foundations and Applications (SBMF 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14414))

Included in the following conference series:

  • 90 Accesses

Abstract

This paper presents a domain specific language, embedded in Haskell (EDSL), for enforcing the information flow policy Delimited Release. To build this language we use Haskell extensions that will allow some kind of dependently-typed programming.

Considering the effort it takes to build a language from scratch, we decided to provide an information-flow security language as an EDSL, using the infrastructure of the host language to support it.

The decision of using Haskell as the implementation language is because it has a powerful type system that makes it possible to encode the security type systems of the embedded language at the type level and also because it is a general purpose language.

The implementation follows an approach where the type of the abstract syntax of the embedded language was decorated with security type information. This way, typed programs will correspond to secure programs, and the verification of the security invariants of programs will be reduced to type-checking.

The embedded security language is designed in a way that is easy to use. We illustrate its use through two examples: an electronic purchase and a secure reading of database information.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://github.com/ceciliamanzino/EDSL-DR-.

References

  1. Lampson, B. W.: Protection. In: Proceedings of the 5th Princeton Conference on Information Sciences and Systems, Princeton (1971). Reprinted in ACM Operating Systems Review, vol. 8, no. 1, pp 18–24 (1974)

    Google Scholar 

  2. Denning, D.E.: A lattice model of secure information flow. ACM 19(5), 236–243 (1976)

    Article  MathSciNet  MATH  Google Scholar 

  3. Goguen, J.A., Meseguer, J.: Security policies and security models. In: Proceedings of the IEEE Symposium on Security and Privacy, pp. 11–20 (1982)

    Google Scholar 

  4. Volpano, D., Smith, G.: A type-based approach to program security. In: Bidoit, M., Dauchet, M. (eds.) CAAP 1997. LNCS, vol. 1214, pp. 607–621. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0030629

    Chapter  Google Scholar 

  5. Myers, A.C., Zheng, L., Zdancewic, S., Chong, S., Nystrom, N.: Jif: java information flow. Software release (2001). http://www.cs.cornell.edu/jif

  6. Sabelfeld, A., Myers, A.C.: A model for delimited information release. In: Futatsugi, K., Mizoguchi, F., Yonezaki, N. (eds.) ISSS 2003. LNCS, vol. 3233, pp. 174–191. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-37621-7_9

    Chapter  Google Scholar 

  7. Sabelfeld, A., Myers, A.C.: Language-based information-flow security. IEEE J. Select. Areas Commun. 21(1), 5–19 (2003)

    Article  Google Scholar 

  8. Myers, A.C., Sabelfeld, A., Zdancewic, S.: Enforcing robust declassification. In: Proceedings of the IEEE Computer Security Foundations Workshop (2004)

    Google Scholar 

  9. Chakravarty, M.M., Keller, G., Jones, S.P., Marlow, S.: Associated types with class. In: POPL (2005)

    Google Scholar 

  10. Russo, A., Claessen, K., Hughes, J.: A library for light-weight information-flow security in Haskell. ACM Sigplan Not. 44(2), 13–24 (2008)

    Article  Google Scholar 

  11. Sabelfeld, A., Sands, D.: Declassification: dimensions and principles. J. Comput. Secur. 17, 517–548 (2009)

    Article  Google Scholar 

  12. Li, P., Zdancewic, S.: Arrows for secure information flow. TCS 411, 1974–1994 (2010)

    Article  MathSciNet  MATH  Google Scholar 

  13. Yorgey, B.A., Weirich, S., Cretin, J., Peyton Jones, S., Vytiniotis, D., Magalhães, J.P.: Giving Haskell a promotion. In: TLDI (2012)

    Google Scholar 

  14. Eisenberg, R.A., Weirich, S.: Dependently typed programming with singletons. ACM SIGPLAN Not. 47(12), 117–130 (2012)

    Article  Google Scholar 

  15. Löh, A.: Applying type-level and generic programming in Haskell (2015)

    Google Scholar 

  16. Manzino, C., Pardo, A.: Agda formalization of a security-preserving translation from flow-sensitive to flow-insensitive security types. Electron. Notes Theoret. Comput. Sci. 351, 75–94 (2020)

    Article  MathSciNet  MATH  Google Scholar 

  17. De Latorre, G.: EDSL en Haskell para la programación segura respecto a la propiedad Delimited Release. Final year project. National University of Rosario, Argentina (2022)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Departamento de Ciencias de la Computación, Universidad Nacional de Rosario, Rosario, Argentina

    Cecilia Manzino & Gonzalo de Latorre

Authors
  1. Cecilia Manzino
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Gonzalo de Latorre
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Cecilia Manzino .

Editor information

Editors and Affiliations

  1. Universidade Federal de Minas Gerais, Belo Horizonte, Brazil

    Haniel Barbosa

  2. Bar-Ilan University, Ramat Gan, Israel

    Yoni Zohar

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Manzino, C., de Latorre, G. (2024). A Haskell-Embedded DSL for Secure Information-Flow. In: Barbosa, H., Zohar, Y. (eds) Formal Methods: Foundations and Applications. SBMF 2023. Lecture Notes in Computer Science, vol 14414. Springer, Cham. https://doi.org/10.1007/978-3-031-49342-3_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-49342-3_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-49341-6

  • Online ISBN: 978-3-031-49342-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation