Model-driven development of information flow-secure systems with IFlow


Smartphone apps and Internet web services are known to often leak their 
users' confidential data to other users or (affiliated) third parties. 
We present a model-driven approach called IFlow that allows the 
development of distributed applications consisting of mobile apps and 
web services with secure information flow. In IFlow, a UML model of an 
information flow-sensitive application is used to automatically 
generate deployable app and web service code as well as a formal model. 
By employing automatic, language-based information flow control as well 
as interactive verification, IFlow enables the developer to give 
verifiable guarantees to the user about how his private data is being 
treated by the application.

In this talk we present how our formal model based on abstract state 
machines is derived automatically from the abstract UML model of the 
application. We also show how runnable code for smartphones and web 
services is generated which can be checked for information flow leaks 
w.r.t. desired noninterference properties.

The talk will be given jointly by Kuzman Katkalov and Kurt Stenzel.