Controlled query evaluation preserves confidentiality in information systems at runtime. A security policy specifies the facts a certain user is not allowed to know. At each query, a censor checks whether the answer would enable the user to learn any classified information. In that case, the answer is distorted, either by lying or by refusal. We introduce a framework in which controlled query e...

David Parnas wrote several papers in the 1970’s and 1980’s that are now considered classics. The concepts he advocated such as information hiding and use of abstract interfaces are generally accepted as the appropriate way to design nontrivial software systems. However, not all of what he proposed has been fully appreciated and assimilated into our practices. Many of his simple, elegant ideas h...

We present a powerful and flexible method for automatically checking the secrecy of values inside components. In our framework an attacker may monitor the external communication of a component, interact with it and monitor the components resource usage. We use an automata model of components in which each transition is tagged with resource usage information. We extend these automata to pass val...

This paper discusses the hardware foundations of the cryptosystem employed by the Xbox video game console from Microsoft. A secret boot block overlay is buried within a system ASIC. This secret boot block decrypts and verifies portions of an external FLASH-type ROM. The presence of the secret boot block is camouflaged by a decoy boot block in the external ROM. The code contained within the secr...