Using Bytecode Instrumentation to Secure Information Flow in Multithreaded Java Applications

Information leakage is considered one of the vulnerabilities that may exist in careless development of software applications or unreliable and untrusted COTS binaries. Providing security at the level of programming development is important because leaking sensitive information such as credit card number, cookies, passwords or SSN does not require a lot of bandwidth to get through. In this paper, we propose a Secure Information Flow for Multithreaded Java (SIF-MJ) model, to enforce security and enhance assurance in all information flows throughout the execution time of the application without violating any rules or properties of multithreaded application. SIF-MJ does not require modification on the underlying Java Virtual Machine (JVM), therefore our proposed model is applicable to the currently existing JVMs.