Skip to main content
SpringerLink
Log in

Secure Refactoring with Java Information Flow

  • Conference paper
Data Privacy Management, and Security Assurance (DPM 2015, QASA 2015)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 9481))

Abstract

Refactoring means that a program is changed without changing its behaviour from an observer’s point of view. Does the change of behaviour also imply that the security of the program is not affected by the changes? Using Myers and Liskov’s distributed information flow control model DLM and its Java implementation Jif, we explore this question practically on common patterns of Refactoring as known from Fowler. We first illustrate on an example the “Extract method” refactoring and how it can endanger confidentiality. We then show how to construct a secure version of this major refactoring pattern by employing Jif to control information flows. Finally, we can show that security leaks as encountered at the outset are not possible anymore.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 84.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    “Extract method” has been coined the refactoring rubicon [4].

References

  1. Boudol, G., Castellani, I.: Noninterference for concurrent programs. In: Orejas, F., Spirakis, P.G., van Leeuwen, J. (eds.) ICALP 2001. LNCS, vol. 2076, p. 382. Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  2. Chothia, T., Kawamoto, Y., Novakovic, C.: LeakWatch: estimating information leakage from Java programs. In: Kutyłowski, M., Vaidya, J. (eds.) ICAIS 2014, Part II. LNCS, vol. 8713, pp. 219–236. Springer, Heidelberg (2014)

    Chapter  Google Scholar 

  3. Denning, D.E., Denning, P.J.: Certification of programs for secure information flow. Commun. ACM 20(7), 504–513 (1977)

    Article  Google Scholar 

  4. Fowler, M.: Refactoring: Improving the Design of Existing Code. Addison Wesley, Reading (2004)

    MATH  Google Scholar 

  5. Helke, S.: Jif examples. http://www.informatik.tu-cottbus.de/~helke/jif/

  6. Mantel, H.: On the composition of secure systems. Security and Privacy (2002)

    Google Scholar 

  7. McComb, T.: Refactoring object-Z specifications. In: Wermelinger, M., Margaria-Steffen, T. (eds.) FASE 2004. LNCS, vol. 2984, pp. 69–83. Springer, Heidelberg (2004)

    Chapter  Google Scholar 

  8. Mens, T., Eeetvelde, N.V., Demeyer, S., Janssens, D.: Formalising refactorings with graph transformations. J. Softw. Maintenance 17(4), 247–276 (2005)

    Article  Google Scholar 

  9. Mens, T., Tourvé, T.: A survey of software refactoring. IEEE Trans. Softw. Eng. 30(2), 126–139 (2004)

    Article  Google Scholar 

  10. Myers, A.C., Liskov, B.: A decentralized model for information flow control. In: ACM symposium on Operating Systems Principles, SOSP. ACM (1997)

    Google Scholar 

  11. Ruhroth, T., Wehrheim, H., Ziegert, S.: Rel: A generic refactoring language for specification and execution. In: EUROMICRO. IEEE (2011)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Brandenburgische Technische Universität Cottbus-Senftenberg, Cottbus, Germany

    Steffen Helke

  2. Middlesex University, London, UK

    Florian Kammüller

  3. Technical University of Denmark, Kongens Lyngby, Denmark

    Christian W. Probst

Authors
  1. Steffen Helke
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Florian Kammüller
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Christian W. Probst
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Steffen Helke .

Editor information

Editors and Affiliations

  1. Telecom SudParis, Evry, France

    Joaquin Garcia-Alfaro

  2. Universitat Autònoma de Barcelona, Bellaterra, Spain

    Guillermo Navarro-Arribas

  3. University of Urbino, Urbino, Italy

    Alessandro Aldini

  4. National Research Council - C.N.R., Pisa, Italy

    Fabio Martinelli

  5. Department of Computer Science, TU Darmstadt, Darmstadt, Germany

    Neeraj Suri

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Helke, S., Kammüller, F., Probst, C.W. (2016). Secure Refactoring with Java Information Flow. In: Garcia-Alfaro, J., Navarro-Arribas, G., Aldini, A., Martinelli, F., Suri, N. (eds) Data Privacy Management, and Security Assurance. DPM QASA 2015 2015. Lecture Notes in Computer Science(), vol 9481. Springer, Cham. https://doi.org/10.1007/978-3-319-29883-2_19

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-29883-2_19

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-29882-5

  • Online ISBN: 978-3-319-29883-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation