透明的IFC实施：可能性和（不）效率结果
Transparent IFC Enforcement: Possibility and (In)Efficiency Results
摘要：
信息流控制（IFC）是一系列技术的集合，用于确保不写不读的安全策略，称为不干扰。静态和动态IFC的传统方法在实际程序中存在大量的错误警报。安全多执行（SME）承诺提供安全的IFC，而不修改已经安全的程序的行为，这是一种称为透明度的属性。SME的实现存在于网络上，并作为几种程序设计语言的插件。此外，SME在理论上可以以黑盒方式工作，这意味着它可以是程序设计语言不可知的，这使得它非常适合保护遗留系统或第三方系统。因此，SME及其变体，如Multiple Facets（MF）和Faceted Secure Multi-Execution（FSME），似乎是安全工程师的灵丹妙药。问题是，既然有这么多优点，为什么这些技术在实践中并不普遍？答案部分在于运行时和内存开销的问题。在许多重要情况下，SME及其变体的部署成本极其昂贵。为什么会这样呢？从表面上看，原因很简单。SME家族中的技术都依赖于多执行的思想，多次运行程序的全部或部分以实现不干扰。自然，这会导致开销。然而，国际金融公司的目标是克服这些间接费用。在本文中，我们认为，有根本的原因，预计这是不可能的，并证明了两个关键定理：1。所有透明实施都是多项式时间等效于多执行。2.所有黑盒强制执行所花费的时间与安全网格中的主体数量成指数关系。我们也回答，在肯定的，一个开放的问题，透明地执行TINI安全条件的可能性。
英文摘要：
Information Flow Control (IFC) is a collection of techniques for ensuring a no-write-down no-read-up style security policy known as noninterference. Traditional methods for both static and dynamic IFC suffer from untenable numbers of false alarms on real-world programs. Secure Multi-Execution (SME) promises to provide secure IFC without modifying the behaviour of already secure programs, a property known as transparency. Implementations of SME exist for the web and as plug-ins to several programming languages. Furthermore, SME can in theory work in a black-box manner, meaning that it can be programming language agnostic, making it perfect for securing legacy or third-party systems. As such SME, and its variants like Multiple Facets (MF) and Faceted Secure Multi-Execution (FSME), appear to be a family of panaceas for the security engineer. The question is, how come, given all these advantages, that these techniques are not ubiquitous in practice? The answer lies, partially, in the issue of runtime and memory overhead. SME and its variants are prohibitively expensive to deploy in many non-trivial situations. Why is this the case? On the surface, the reason is simple. The techniques in the SME family all rely on the idea of multi-execution, running all or parts of a program multiple times to achieve noninterference. Naturally, this causes overhead. However, the goal in the IFC community has been to overcome these overheads. In this paper we argue that there are fundamental reasons to expect this not to be possible and prove two key theorems: 1. All transparent enforcement is polynomial time equivalent to multi-execution. 2. All black-box enforcement takes time exponential in the number of principals in the security lattice. We also answer, in the affirmative, an open question about the possibility of transparently enforcing the TINI security condition.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
