Information Flow Security Certification for SPARK Programs - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2020

Information Flow Security Certification for SPARK Programs

Sandip Ghosal
  • Function : Author
  • PersonId : 1100404
R. K. Shyamasundar
  • Function : Author
  • PersonId : 1026655


SPARK 2014 (SPARK hereafter) is a programming language designed for building highly-reliable applications where safety and security are key requirements. SPARK platform performs a rigorous data/information flow analysis to ensure the safety and reliability of a program. However, the flow analysis is oriented towards establishing functional correctness and does not analyze for flow security of the program. Thus, there is a need to augment the analysis that would enable us to certify SPARK programs for security. In this paper, we propose an analysis to find information flow leaks in a SPARK program using a Dynamic Labelling (DL) approach for multi-level security (MLS) programs and describe an effective algorithm for detecting information leaks in SPARK programs, including classes of termination/progress-sensitive computations. Further, we illustrate the application of our approach for overcoming information leaks through unsanitized sensitive data. We also show how SPARK can be extended for realizing MLS systems that invariably need declassification through the illustration of an application of the method for security analysis of Needham-Schroeder public-key protocol.
Fichier principal
Vignette du fichier
496047_1_En_8_Chapter.pdf (427.84 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03243629 , version 1 (31-05-2021)





Sandip Ghosal, R. K. Shyamasundar. Information Flow Security Certification for SPARK Programs. 34th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jun 2020, Regensburg, Germany. pp.137-150, ⟨10.1007/978-3-030-49669-2_8⟩. ⟨hal-03243629⟩
45 View
6 Download



Gmail Facebook Twitter LinkedIn More