Daniel Schoepe

Learn More
The root cause for <i>confidentiality</i> and <i>integrity</i> attacks against computing systems is insecure <i>information flow</i>. The complexity of modern systems poses a major challenge to secure <i>end-to-end</i> information flow, ensuring that the insecurity of a single component does not render the entire system insecure. While information flow in a(More)
Research in information-flow security aims at developing methods to identify undesired information leaks within programs from private (high) sources to public (low) sinks. For a concurrent system, it is desirable to have compositional analysis methods that allow for analyzing each thread independently and that nevertheless guarantee that the parallel(More)
Taint tracking is a popular security mechanism for tracking data-flow dependencies, both in high-level languages and at the machine code level. But despite the many taint trackers in practical use, the question of what, exactly, tainting means - what security policy item bodies - remains largely unexplored. We propose explicit secrecy, a generic framework(More)
This paper puts a spotlight on the specification and enforcement of opacity, a security policy for protecting sensitive properties of system behavior. We illustrate the fine granularity of the opacity policy by location privacy and privacy-preserving aggregation scenarios. We present a general framework for opacity and explore its key differences and formal(More)
Taint tracking has been successfully deployed in a range of security applications to track data dependencies in hardware and machine-, binary-, and high-level code. Precision of taint tracking is key for its success in practice: being a vulnerability analysis, false positives must be low for the analysis to be practical. This paper presents an approach to(More)
Patrick Boba, Dominik Bollmann, Daniel Schoepe, Nora Wester, Jan Wiesel and Kay Hamacher* 1 Computational Biology and Simulation, Department of Biology, Technical University Darmstadt, Darmstadt, Germany 2 Department of Computer Science, Technical University Darmstadt, Darmstadt, Germany 3 Department of Physics, Technical University Darmstadt, Darmstadt,(More)
Modern web and mobile applications are complex entities amalgamating different languages, components, and platforms. The rich features span the application tiers and components, some from third parties, and require substantial efforts to ensure that the insecurity of a single component does not render the entire system insecure. As of today, the majority of(More)
While information-flow security is a well-established area, there is an unsettling gap between heavyweight information-flow control, with formal guarantees yet limited practical impact, and lightweight tainting techniques, useful for bug finding yet lacking formal assurance. This paper proposes a framework for exploring the middle ground in the range of(More)
  • 1