.png){kind=icon}
.png){kind=icon}
Return
Fipa: Fine-Grained Information-Flow-Driven Program Partitioning
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2026.104863.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Program partitioning is a key security technique for reducing the attack surface and enforcing strong isolation. In many application scenarios, the partitioning method enforces information-flow security policy to prevent the leakage of sensitive data from the sensitive partition. However, existing information-flow-driven approaches are qualitative and coarse-grained, overestimating sensitivity, and inflating the code of the sensitive partition, which includes the TCB code in confidentiality protection or the tainted code in integrity protection. We present Fipa, a statement-level partitioning framework for complex C programs driven by quantitative information-flow analysis. We employ context-sensitive dynamic information flow tracking to measure the leakage of each statement precisely. We then construct a Sensitivity Quantity Graph for modeling the statement-level code size and leakage, and formulate the partitioning task as a binary integer programming problem to classify the statements and obtain the optimal boundaries under a configurable allowed leakage limit. To generate the executable partitioned program, we use function slicing to enforce statement-level partition boundaries and automatically instrument RPC primitives. Evaluations on real-world applications and benchmarks demonstrate that Fipa achieves strong isolation, yielding lower sensitive code ratio and CPU overhead than the PM. Moreover, Fipa effectively mitigates the impact of real-world vulnerabilities.
Keywords:
Fine-grained partitioning
Information-flow analysis
Program slicing
Binary integer programming
Security isolation
Journal
C
IF:
5.4
Papers:
189
Citations:
0