一句话：首次实现面向现成 Rust 及其未修改编译器的混合静态–动态信息流控制，支持保密性与完整性。
细粒度信息流控制（IFC）可在语言层面保证保密性与完整性，但已有支持不实用：全程序静态分析易误报，修改语言与编译器又妨碍采用。Cocoon 能在不修改 Rust 语言与编译器的情况下提供细粒度 IFC，却仅支持静态保密标签且案例有限。本文提出 Carapace，沿用 Cocoon 的核心思路，同时支持静态与动态 IFC，并覆盖保密性与完整性。作者以三个真实应用和完整安全策略开展案例研究。评估显示，应用只需少量修改即可迁移，且多数情况下运行时开销可忽略。Carapace 是首个与现成 Rust 及未修改编译器配合的混合静态–动态 IFC 方案。
Fine-grained information flow control (IFC) ensures confidentiality and integrity at the programming language level by ensuring that high-secrecy values do not affect low-secrecy values and that low-integrity values do not affect high-integrity values. However, prior support for fine-grained IFC is impractical: It either analyzes programs using whole-program static analysis, detecting false IFC violations; or it extends the language and compiler, thwarting adoption. Recent work called Cocoon demonstrates how to provide fine-grained IFC for Rust programs without modifying the language or compiler, but it is limited to static secrecy labels, and its case studies are limited. This paper introduces an approach called Carapace that employs Cocoon’s core approach and supports both static and dynamic IFC and supports both secrecy and integrity. We demonstrate Carapace using three case studies involving real applications and comprehensive security policies. An evaluation shows that applications can be retrofitted to use Carapace with relatively few changes, while incurring negligible run-time overhead in most cases. Carapace advances the state of the art by being the first hybrid static—dynamic IFC that works with an off-the-shelf language—Rust—and its unmodified compiler.
@article{paperbot3211,
title = {Carapace: Static–Dynamic Information Flow Control in Rust},
author = {Vincent Beardsley and Chris Xiong and Ada Lamba and Michael D. Bond},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA1},
year = {2025},
doi = {10.1145/3720427}
}