💻 computer science

Filament: Denning-Style Information Flow Control for Rust

Filament is a Denning-style static information-flow control library for Rust that achieves fine-grained security enforcement without compiler modifications by leveraging type inference for explicit flows, a lightweight `pc_block!` construct for implicit flows, and specialized macros for seamless library interoperability, all while offering a more permissive programming model than existing solutions like Cocoon.

Original authors: Jeffrey C. Ching, Quan Zhou, Danfeng Zhang

Published 2026-04-17

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jeffrey C. Ching, Quan Zhou, Danfeng Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are running a high-security bank. You have two types of money: Public Cash (everyone can see and touch) and Secret Gold (only the vault manager can handle).

In the world of computer programming, this is called Information Flow Control (IFC). The goal is to make sure "Secret Gold" never accidentally leaks into the "Public Cash" register, and that no one can use the Secret Gold to influence public decisions in a sneaky way.

For a long time, building a system to do this in modern programming languages (like Rust) was like trying to build a new bank vault inside a moving train. You either had to:

Stop the train and rebuild the engine (modify the compiler), which is expensive and slow.
Put the gold in a tiny, rigid box that you can only open in specific rooms (a "block-level" approach), which makes doing normal banking tasks incredibly frustrating and restrictive.

Filament is a new tool that solves this problem without stopping the train or building a rigid box. It's like giving every single coin a magical, invisible tag that the bank's security system can read instantly, without needing to rebuild the whole bank.

Here is how Filament works, using some everyday analogies:

1. The Problem with the Old Way (Cocoon)

Before Filament, there was a tool called Cocoon. Imagine Cocoon is like a "Secret Room" policy.

If you want to touch the Secret Gold, you must step into a Secret Room.
Inside the room, you can't talk to anyone outside, you can't change the furniture (side effects), and you can only bring out what you brought in.
The Annoyance: If you just wanted to do a simple math problem with the gold, you had to carry it into the room, do the math, and carry it back out. If you wanted to use a tool from the public lobby (a third-party library), you had to strip the gold of its "Secret" tag, use the tool, and hope you remembered to put the tag back on. If you forgot, the gold leaked!

2. The Filament Solution: "Smart Tags"

Filament changes the game. Instead of putting the gold in a room, it puts a smart, invisible tag on every single piece of data.

The "Label" (The Tag): Every piece of data in your program has a security level (Public, Secret, Top Secret).
The "Flow" (The Traffic Rules): The system automatically checks: "Can this Secret Gold flow into this Public slot?" If the answer is no, the program refuses to run.
The Magic: It does this using Type Inference. Think of it like a smart assistant who knows the rules so well that you don't have to write them down for every single step. You just say, "This is Secret," and the system figures out the rest.

3. Three Cool Tricks Filament Uses

A. The "PC Block" (The Traffic Light)

Sometimes, a decision depends on a secret.

Example: "If the Secret Gold amount is over $1,000, turn on the Red Light."
In the old way, the whole room had to be a "Secret Room" because the decision was secret.
Filament's Trick: It uses a special construct called pc_block!. It's like a Traffic Light that changes color based on the secret.
- If the light is Red (Secret), the system says, "Okay, anything you do right now must also be Secret."
- Once the decision is made and the light turns Green (Public), the system relaxes. You don't need a whole room; you just need to be careful at the exact moment the light is red. This saves a massive amount of hassle.

B. The "Magic Wrapper" (fcall! and mcall!)

Programmers often use tools built by others (like a calculator app or a database). These tools don't know about Secret Gold; they only know about regular numbers.

The Old Way: You had to strip the Secret Gold tag, give the number to the tool, and then desperately try to remember to put the tag back on. If you forgot, the gold was gone.
Filament's Trick: It uses fcall! and mcall! macros. Think of these as Magic Gloves.
- You put the Secret Gold in the glove.
- You hand the glove to the tool.
- The tool does its work.
- When the tool is done, the Magic Gloves automatically put the Secret Gold tag back on the result. You never have to worry about forgetting to re-label it.

C. The "No-Compiler-Needed" Promise

The biggest win is that Filament works with standard Rust. You don't need to hire a team of engineers to rebuild your compiler. It's a library you just add to your project, like adding a plugin to a video game.

4. Why This Matters

The paper tested Filament on real-world apps (like a Battleship game, a Spotify client, and a secure email system).

Less Work: Programmers had to write fewer "security notes" (annotations) compared to the old way.
More Freedom: It didn't force them to use "escape hatches" (cheats) to get things done.
Speed: It didn't slow down the computer. In fact, it was almost as fast as writing code without any security checks at all.

The Bottom Line

Filament is like upgrading a bank's security from "Lock the whole building" to "Give every employee a smart badge."

The badge knows exactly where you are allowed to go.
It doesn't stop you from doing your job.
It doesn't require rebuilding the bank.
And most importantly, it makes sure the Secret Gold stays secret, even when you are using tools from the public lobby.

It brings high-level, military-grade security to everyday programming, making it practical, easy to use, and safe.

1. Problem Statement

Information Flow Control (IFC) is essential for preventing unauthorized data leakage and ensuring confidentiality and integrity. However, existing IFC tools face a fundamental trade-off:

Denning-style systems: These offer fine-grained, precise tracking of both explicit (data assignment) and implicit (control-flow) flows using a Program Counter ($pc$) label. However, they typically require compiler modifications (custom type checkers), making them difficult to adopt for mainstream languages like Rust.
Library-based/Coarse-grained systems: Recent approaches like Cocoon (for Rust) avoid compiler changes by using a "block-level" IFC model. They encapsulate sensitive data within secret_block! macros. While practical, this approach is restrictive:
- It requires frequent "escape hatches" (e.g., unchecked_operation, declassify) to bypass security checks for legitimate side effects or third-party library calls.
- It forces all computations involving secrets to occur within a single block, leading to "label creep" or unnecessary declassification.
- It lacks the ability to track implicit flows at the expression level without wrapping entire code blocks.

The Core Challenge: How to implement a Denning-style, fine-grained IFC system in a mainstream language like Rust without modifying the compiler, while minimizing annotation overhead and avoiding the restrictive programming model of block-level IFC.

2. Methodology: The Filament Approach

Filament is a static IFC library for Rust that achieves Denning-style security through metaprogramming (macros) and Rust's type system (traits, generics, and inference), requiring zero compiler modifications.

Key Design Components:

Labeled Data via Phantom Types:
- Sensitive data is wrapped in a generic struct Labeled<T, L>, where T is the value and L is a security label (e.g., Public, A, B).
- Security labels are encoded as zero-sized types using phantom types, ensuring no runtime overhead.
- A FlowsTo trait defines the lattice ordering ( $\ell_1 \sqsubseteq \ell_2$ ), and a Join trait computes the least upper bound (join) of labels at compile time.
Explicit Flow Control (Variable Level):
- relabel! Macro: To assign a value with a lower security label to a variable with a higher label (e.g., Public $\to$ Secret), Filament uses relabel!(expr, Target). This macro performs a compile-time check using the FlowsTo trait to ensure the flow is safe.
- Type Inference: For operations combining labeled values (e.g., x + y), Filament leverages Rust's type inference to automatically compute the resulting label as the join of the operands' labels, reducing manual annotation.
Implicit Flow Control (Control Flow Level):
- pc_block! Macro: This is the core innovation for handling implicit flows without a compiler.
  - It initializes a local Program Counter ($pc$) label based on the sensitivity of the branch condition.
  - It rewrites assignments inside the block to check that the target variable's label is at least as restrictive as the current $pc$.
  - It tracks nested branches, updating the $pc$ label dynamically within the macro expansion.
- Unlike Cocoon, which requires all code manipulating secrets to be in a block, Filament only requires pc_block! when the control flow condition itself depends on sensitive data.
Interoperability with Standard/Third-Party Libraries:
- fcall! and mcall! Macros: Standard Rust functions and methods are "security-agnostic" (they expect raw types, not Labeled<T, L>).
  - fcall! automatically unwraps labeled arguments, calls the function, and re-wraps the result with the join of all input labels.
  - mcall! preserves the label of the receiver object when calling methods or accessing fields.
- This eliminates the need for manual wrap/unwrap cycles and prevents the security risks associated with manual declassification.

3. Key Contributions

First Denning-Style IFC for Rust without Compiler Changes: Filament is the first system to bring fine-grained, $pc$-based IFC to a mainstream imperative language using only library-level techniques.
Novel Constructs for Fine-Grained Control:
- Introduction of pc_block! to enforce implicit flow constraints at the expression level.
- Introduction of fcall! and mcall! to seamlessly integrate with the Rust ecosystem.
Reduced Annotation Burden: By leveraging Rust's type inference, Filament minimizes the need for explicit type annotations, making the code look closer to standard Rust.
More Permissive Programming Model: Filament eliminates the need for "secret blocks" that restrict side effects, allowing developers to write more natural code while maintaining security guarantees.

4. Evaluation Results

The authors evaluated Filament by re-implementing five applications (Calendar, Battleship, Spotify TUI, Servo, and JPMail) originally written for Cocoon or Jif.

Annotation Overhead:
- Filament required fewer lines of code and fewer API calls than Cocoon in most cases.
- While Filament has more label annotations (due to fine-grained tracking), it drastically reduces API calls (e.g., no need for secret_block!, wrap_secret, or unwrap_secret).
- Example: In the Battleship game, Filament required 2 API calls vs. Cocoon's 23.
Permissiveness (Escape Hatches):
- Filament significantly reduced the need for escape hatches.
- Cocoon required 12 unnecessary declassify operations and 2 unchecked_operation calls across the test suite to bypass its restrictive block-level rules.
- Filament required zero unchecked_operation calls and only intentional declassify calls where logic demanded it.
Compilation Overhead:
- Filament introduced negligible compile-time overhead (e.g., +0.45% for Spotify TUI, -2.32% for Servo due to cache effects).
- The overhead scales with the ratio of IFC library compilation to total build time, meaning it becomes less significant as codebases grow.

5. Significance

Practical Adoption: By removing the need for compiler modifications, Filament makes advanced IFC accessible to the vast Rust ecosystem, including existing large-scale projects.
Security Precision: It solves the "label creep" problem inherent in coarse-grained systems by resetting the $pc$ label after sensitive branches, allowing safe public outputs from sensitive computations.
Developer Experience: It bridges the gap between theoretical security models and practical engineering. Developers can write code that resembles standard Rust while receiving strong, provable confidentiality guarantees.
Future Direction: It sets a precedent for implementing complex static analysis tools (like IFC) in modern languages using macro systems and type inference, potentially inspiring similar work in other languages.

In summary, Filament successfully demonstrates that fine-grained, Denning-style IFC is achievable in Rust without compiler hacks, offering a superior balance of security, performance, and developer usability compared to previous block-level approaches.