Securing the Web with Decentralized Information Flow Control
This archived UWTV program features a talk on securing web sites and future web computing platforms using Decentralized Information Flow Control (DIFC), an operating system technique designed to enhance security. The lecture explores how DIFC tracks the flow of sensitive data as it's copied and communicated between files and processes, providing a more robust security model than traditional operating systems.
Understanding Decentralized Information Flow Control (DIFC)
In essence, DIFC offers a way to monitor and control how information moves within a system. Imagine a digital document containing confidential financial data. A standard operating system might rely on access control lists (ACLs) to restrict who can open or edit the file. However, once a user with sufficient permissions accesses the document, they could potentially copy the data into another file, email it, or print it, bypassing the original restrictions.
DIFC addresses this limitation by tagging data with security labels. These labels persist as the data is copied, transformed, and transmitted. The system then enforces policies based on these labels, preventing unauthorized dissemination. For example, a policy might state that data labeled "Confidential" cannot be sent over an unencrypted network connection or copied into a file accessible to unauthorized users.
The Advantages of DIFC
The speaker, Maxwell Krohn, highlights a key advantage of DIFC: it allows developers to concentrate security-critical code in small, easily auditable "declassifiers."
* **Simplified Security Audits:** Instead of meticulously reviewing vast amounts of code for potential security vulnerabilities, developers can focus on the relatively small declassifiers. These declassifiers are responsible for downgrading the security labels of data under specific, controlled circumstances.
* **Improved Maintainability:** As systems grow and evolve, new features are often added. With traditional security models, each new feature introduces potential security risks that require careful evaluation. DIFC helps to mitigate this risk by isolating security-critical logic, making it easier to maintain a secure system even as it grows in complexity.
* **Enhanced Security:** By tracking data flow, DIFC provides a more granular level of control over sensitive information. This makes it more difficult for attackers to exfiltrate data or compromise the system.
Maxwell Krohn: Speaker Profile
Maxwell Krohn, the speaker in this archived program, is a computer scientist from the Massachusetts Institute of Technology (MIT). His expertise likely lies in operating systems, security, and programming languages. His work on DIFC reflects a deep understanding of the challenges in securing complex software systems. His insights offer valuable perspectives on innovative approaches to data protection.
Accessing the Archived Program
The UWTV program offers several options for accessing the lecture:
* **Video Streams:** Streams are available at various bitrates (56kbps to 1.5Mbps+) to accommodate different internet connection speeds. QuickTime is required to view these streams.
* **Downloads:** The program is available for download in both MP3 (audio) and MPEG-4 (video) formats. Right-click on the link and select "Save Target/Link As..." to save the file to your computer.
Program Information
* **Series Title:** CSE Colloquia - 2008
* **Subject(s):** Engineering and Computer Science
* **Speaker(s):** Maxwell Krohn, Computer Science, Massachusetts Institute of Technology
* **Production Date:** May 1, 2008
* **Runtime:** 00:55:16
* **Rating:** TV-G