Hybrid Information Flow Analysis for Real-World C Code - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2017

Hybrid Information Flow Analysis for Real-World C Code


Information flow analysis models the propagation of data through a software system and identifies unintended information leaks. There is a wide range of such analyses, tracking flows statically, dynamically, or in a hybrid way combining both static and dynamic approaches. We present a hybrid information flow analysis for a large subset of the C programming language. Extending previous work that handled a few difficult features of C, our analysis can now deal with arrays, pointers with pointer arithmetic, structures, dynamic memory allocation, complex control flow, and statically resolvable indirect function calls. The analysis is implemented as a plugin to the Frama-C framework. We demonstrate the applicability and precision of our analyzer by applying it to an open-source cryptographic library. By combining abstract interpretation and monitoring techniques, we verify an information flow policy that proves the absence of control-flow based timing attacks against the implementations of many common cryptographic algorithms. Conversely, we demonstrate that our analysis is able to detect a known instance of this kind of vulnerability in another cryptographic primitive.
Fichier principal
Vignette du fichier
hybrid_information_flow.pdf (250.49 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01658653 , version 1 (07-12-2017)



Gergö Barany, Julien Signoles. Hybrid Information Flow Analysis for Real-World C Code. TAP 2017 - 11th International Conference on Tests & Proofs, Jul 2017, Marburg, Germany. pp.23-40, ⟨10.1007/978-3-319-61467-0_2⟩. ⟨hal-01658653⟩
223 View
356 Download



Gmail Facebook X LinkedIn More