Language-Based Security VT16

TDA602/TDA601/DIT103/DIT101 - Språkbaserad datasäkerhet

Latest news

Security specialization

This course is a part of the Chalmers and GU Security Specialization, a package of four courses in computer security.

Why language-based security?

Traditionally, computer security has been largely enforced at the level of operating systems. However, operating-system security policies are low-level (such as access control policies, protecting particular files), while many attacks are high-level, or application-level (such as email worms that pass by access controls pretending to be executed on behalf of a mailer application). The key to defending against application-level attacks is application-level security. Because applications are typically specified and implemented in programming languages, this area is generally known as language-based security. A direct benefit of language-based security is the ability to naturally express security policies and enforcement mechanisms using the developed techniques of programming languages.

Who should study language-based security?

You should have previously studied a course in programming languages (and of course basic programming skills are assumed) and basics of computer security. It is an advantage if you have studied courses such as semantics of programming languages and compiler construction.

You should be interested in some of the following:

What will you learn?

After the course, you should be able to apply practical knowledge of security for modern programming languages. This includes the ability to identify application- and language-level security threats, design and argue for application- and language-level security policies, and design and argue for the security, clarity, usability, and efficiency of solutions, as well as implement such solutions in expressive programming languages. You should be able to demonstrate the critical knowledge of principles behind such application-level attacks as race conditions, buffer overruns, and code injections. You should be able to master the principles behind such language-based protection mechanisms as static security analysis, program transformation, and reference monitoring.


This course combines practical and cutting-edge research material. For the practical part, the dual perspective of attack vs. protection is threaded through the lectures, laboratory assignments, and projects. For the cutting-edge research part, the course's particular emphasis is on the use of formal, or semantic, models of program behaviour for specifying and enforcing security properties.


Knowledge of the material covered in the courses Programming Languages and Computer Security is recommended although not required as a prerequisite.

Instructor and TAs

Instructor: Andrei Sabelfeld, office 5476, voice 1018 (Chalmers).

Teaching assistants: Alexander Sjösten, office 5449, voice 6167, and Daniel Hausknecht, office 5447, voice 6163.

Course literature

No specific book is used as a course book. The material consists of hand-outs, papers, etc. However, I recommend the following book for complimentary reading on the subject:

Lecture/supervision schedule and deadlines

The schedule is subject to change. Stay tuned!

Last year's lecture slides are already on the web, but changes and updates may be done before the actual lecture. If these updates are substantial then it will be indicated in the latest news section.

In order to view the slides, you need to be under the .se domain. Otherwise, let us know your domain - we will include it in the permission set.

All deadlines are firm.
When Topic Reading
Mon, Mar 21, 10-12, EF Introduction to language-based security. Overview of the course.
Slides: here.
McGraw and Morrisett, Attacking Malicious Code:  A Report to the Infosec Research Council, 2000.
Sect. I of Saltzer and Schroeder, Protection of Information in Computer Systems, 1975.
Tue, Mar 22 OWASP Gothenburg event: Static Code Analysis for the Masses. Registration is here. First come, first served!
Wed, Mar 23, 13-15, ED Design principles for security protocols Abadi and Needham, Prudent Engineering Practice for Cryptographic Protocols, 1995.
Mon, Apr 11, 10-12, EF Information flow security
Slides: here.
Sabelfeld and Myers, Language-Based Information-Flow Security, 2003.
Try this information flow exercise. See below for exercise supervision time. Bonus: JSFlow challenge.
Wed, Apr 13, 10-12, ED-3507 Exercise: Information Flow Challenge Bonus: JSFlow challenge.
Wed, Apr 13, 13-15, ED-5476 Office hours to consult on project proposals
Fri, Apr 15 Project proposal deadline
Mon, Apr 18, 10-12, EF Data races, randomness, and determinism
Slides: here.
Savage, Burrows, Nelson, Sobalvarro, and Anderson, Eraser: A Dynamic Data Race Detector for Multithreaded Programs, 1997.
Rafnsson and Sabelfeld, Secure Multi-Execution: Fine-grained, Declassification-aware, and Transparent, 2013.
Clark and Hunt, Noninterference for Deterministic Interactive Programs, 2008.
Thu, Apr 21, 15-17, ED-3507 ToCToU lab supervision
Fri, Apr 22 ToCToU lab deadline
Mon, Apr 25, 10-12, EF Buffer overruns; Database security; Privacy-violating information flow in web applications
Slides: here.
Aleph One, Smashing the Stack for Fun and Profit.
Claes Nyberg's slides and tutorial with exercises.
Jang et al, An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications, 2010.
Wed, Apr 27, 10-12, ED-3507 r00tshell lab supervision
Wed, Apr 27, 13-15, ED Advanced Information Flow: Jif, Fabric, Timing Channels
Invited lecture by Aslan Askarov, Aarhus University.
Jif, Fabric, Timing: 1 and 2.
Fri, Apr 29, 10-12, ED-3507 r00tshell lab supervision
Fri, Apr 29 r00tshell lab deadline
Mon, May 2, 10-12, EF Web-application security
Slides: here.
Excess XSS, tutorial by Jakob Kallin and Irene Lobo Valbuena, from their course project in 2013
Wed, May 4, 10-12, ED-3507 WebAppSec lab supervision
Fri, May 6 WebAppSec lab deadline
Mon, May 9, 10-12, EF Java security, Stack inspection and access control
Certifying compilation; Typed Assembly Languages, Proof-Carrying Code; Copyright protection and code obfuscation
Slides: here.
Wallach, Felten, Understanding Java Stack Inspection, 1998.
Morrisett, Walker, Crary, Glew, From System F to Typed Assembly Language, 1999.
Mon, May 9, 13-15, ED-5475 Office hours to consult on projects
Wed, May 11, 13-15, ED Advanced web application security
Lecture by Steven Van Acker.
Slides: here.
Thu, May 12 Project draft to opponents
Mon, May 16, 10-12, EF Project presentations
Presentation time: 7 minutes + 1 minute for questions (strict limit!), following the presentation guidelines. If you are unable to use your laptop for the presentation, just email your powerpoint/pdf presentation to me in advance.
The opponent group must be present and ask at least two questions. Range of groups (as in Fire) to present projects:
Groups 1-11 (except for group 7).
Groups with subsequent numbers are each others' "opponents". For example, groups 1 and 2 oppose each other and so on.
Wed, May 18, 10-12, ED Project presentations continued.
Note that this slot is on Wed morning!
Groups 7, 12-15, 17, 19-22.
Wed, May 18, 13-15, ED Project presentations continued. Groups 23-26, 28-29, 31-32.
Wed, May 25, 13-15, ED Project presentations continued. Groups 16, 27, 34-44.
Fri, May 27 Project report deadline


In order to get up to speed on information flow, try this information flow challenge. See the schedule for the a supervision slot for working on this exercise. Bonus: JSFlow challenge.

Lab assignments and project

You are expected to find a lab partner, with whom you will do the assignments (laborations). If you have difficulties finding a partner, please use the discussion group. No one-person or three-person groups are allowed unless there is a well-justified reason and permission from the instructor.

There are three assignments ("laborations") and a project. The lab are about specific problems whereas projects can be more open-ended (some ideas for projects are supplied below). Further information on the lab and project:

The supervision takes place according to the schedule above.

In case you have passed some of the labs and/or project in previous years, no need to resumbit the solutions. However, you still need to submit a short text file for each passed lab/project saying when (what year) you passed it.

Course requirement and examinations

To pass the course, you must pass the labs and the project part. You need to make a presentation of the project in class and pass the requirements on a written report that documents your project. There is no written question-style exam. Note that a top grade is not possible when failing to play the opponent role during the project presentations.

Student directions for the use of the IT resources at Chalmers

Students are expected to be familiar with the Student directions for the use of the IT resources at Chalmers, which we strictly follow. While we study both attacks and protection, our attitude is exclusively white-hat.

Academic integrity and honesty

Students are expected to be familiar with the Chalmers policy on academic integrity and honesty, which we strictly follow. Cheating includes collaboration between groups and not citing your sources.