A general theory of composition for trace sets closed under selective interleaving functions

Abstract

This paper presents a general theory of system composition for possibilistic" security properties. We see that these properties fall outside of the AlpernSchneider safety liveness domain and hence, are not subject to the Abadi-Lamport Composition Principle. We then introduce a set of trace constructors called selective interleaving functions and show that possibilistic security properties are closure properties with respect to di erent classes of selective i n terleaving functions. This provides a uniform framework for analyzing these properties and allows us to construct a partial ordering for them. We present a n umber of composition constructs, show the extent to which each preserves closure with respect to di erent classes of selective i n terleaving functions, and show that they are su cient for forming the general hook-up construction. We see that although closure under a class of selective i n terleaving functions is generally preserved by product and cascading, it is not generally preserved by feedback, internal system composition constructs, or re nement. We examine the reason for this.

Dynamic vs. Static Flow-Sensitive Security Analysis

“…It is known that noninterference is not a safety property [33], [47]. This, however, does not imply that a safe approximation of noninterference cannot be soundly enforced by a monitor (a trivially secure monitor might simply block all executions).…”

“…It is known that noninterference is not a safety property [33], [47]. Precise characterizations of what can be enforced by monitoring have been studied in the literature (e.g., [44], [22]), where noninterference is discussed as an example of a policy that cannot be enforced precisely by dynamic mechanisms.…”

Unifying Theories of Confidentiality

“…Unfortunately, the relation is not strong enough to preserve confidentiality properties in specifications, since it may introduce new conduits of information flow to low-level users [8,9]. This result can be established in our framework by appealing to the following lemma (from [7]).…”

“…Several semantic frameworks (including the MAKS) for expressing a range of confidentiality properties in a uniform manner have been proposed in the security literature [5,6,9,10,12,13,14]. The objective of these frameworks is to consolidate the existing definitions of noninterference-like properties in the literature, in order to evaluate and compare these properties systematically and to enable new confidentiality properties to be defined rigorously.…”

Designing Secure Service Workflows in BPEL

“…Separability is a security property introduced in [20] and has been defined as complete independence between high (confidential) and low level (public) sequences of actions. For this property to hold there should be no interaction between confidential and public sequences of actions (e.g., running these actions as two separate processes without any communication between them).…”