Controlled Declassification Based on Intransitive Noninterference

Scheduler-Independent Declassification

“…This corresponds to the W-aspects What and Where that we address in this article. The W-aspects of declassification were first introduced in [21] and form the basis for a taxonomy of approaches to controlling declassification [33]. Before presenting our schema WHAT&WHERE s for scheduler-specific security properties that control what is declassified where (see Section 3.3), we introduce the simpler schema WHAT s (see Section 3.2) for controlling what is declassified.…”

“…In the definition of the typing rules, we aimed for conceptual simplicity rather than for maximizing the precision of the analysis. For instance, a more fine-grained treatment of conditionals could be developed by using safe approximation relations (like in [21]). ♦…”

“…In order to make differences in the goals of different approaches to controlling declassification explicit, three aspects of declassification were distinguished in [21]: What information may be declassified, Where information may be declassified, and Who may declassify information. Four dimensions of declassification, which are similar to these W-aspects, are used in [33] to classify existing approaches to declassification.…”

“…Intransitive noninterference [21] and WHERE [20] permit declassification by dedicated declassification commands that comply with a flow relation, which may be an intransitive relation. The properties WHAT 1 and WHAT 2 in [20] control that what is declassified complies with a given set of escape hatches.…”

Intransitive Noninterference in the Action-disordered System

“…It was further promulgated by Rushby [4]. And the definition remains in use and continues to be the subject of research [5][6][7][8][9]. In [9], Meyden rewrites the function purge and ipurge and proposes ta, to and ito.…”