Rewriting-based security enforcement of concurrent systems: A formal approach

Program security enforcement is designed to ensure that a program respects a given security policy, which generally specifies the acceptable executions of that. In general, the enforcement is achieved by adding some controls (tests) inside the target program or process. The major drawback of existing techniques is either their lack of precision or their inefficiency, especially those dedicated for concurrent languages. This paper proposes an efficient algebraic and fully automatic approach for security program enforcement: given a concurrent program P and a security policy φ, it automatically generates another program P' that satisfies φ and behaves like P, except that it stops when P tries to violate the security policy φ.