Confidentiality and Integrity with Untrusted Hosts
Steve Zdancewic, Andrew C. Myers · 2000
Several security-typed languages have recently been proposed to enforce security properties such as confidentiality or integrity by type checking. We propose a new security-typed language, Spl@, that addresses two important limitations of previous approaches. First, existing languages assume that the underlying execution platform is trusted; this assumption does not scale to distributed computation in which a variety of diffierently trusted hosts are available to execute programs. Our new approach, secure program partitioning, translates programs written assuming complete trust in a single executing host into programs that execute using a collection of variously trusted hosts to perform computation. As the trust configuration of a distributed system evolves, this translation can be performed as necessary for security. Second, many common program transformations do not work in existing security-typed languages; although they produce equivalent programs, these programs are reject...