Vous pouvez vous abonner à nos annonces de séminaires
                     http://gallium.inria.fr/seminaires/

                             S E M I N A I R E
       __                                  
      / _`  _   /  /  o                       /| /|   __  __  __ __    _  _
     /   ) __) /  /  / /  / /\/|    -----    / |/ |  /  )(_  /  /  ) ) ) __)
    (___/ (_/ (_ (_ / (__/ /   |            /     | (__/ __)(_ (__/ (_/ (_/
                                                
                          I N R I A - Rocquencourt
                        Amphi Turing du bâtiment 1

                            Lundi 14 juin, 10h30

                              ---------------
                              Steve Zdancewic
                              ---------------

                         University of Pennsylvania

         =========================================================
         Aura: A Programming Language with Authorization and Audit
         =========================================================

Existing mechanisms for authorizing and auditing the flow of
information in networked computer systems are insufficient to meet the
security requirements of high-assurance software systems.  Current
best practices typically rely on operating-system provided file
permissions for authorization and an ad-hoc combination of OS and
network-level (e.g. firewall-level) logging to generate audit trails.

This talk will describe work on a security-oriented programming
language called Aura that attempts to address this problem of
auditable information flows in a more principled way.  Aura supports a
built-in notion of principal and its type system incorporates ideas
from authorization logic and information-flow constraints.  These
features, together with the Aura run-time system, enforce strong
information-flow policies while generating good audit trails.  These
audit trails record access-control decisions (such as uses of
downgrading or declassification) that influence how information flows
through the system.  Aura's programming model is intended to smoothly
integrate information-flow and access control constraints with the
cryptographic enforcement mechanisms necessary in a distributed
computing environment.


This is joint work with Jeff Vaughan, Limin Jia, Karl Mazurak,
Jianzhou Zhou, Joseph Schorr, and Luke Zarko.