Discretionary Information Flow Control for Interaction-Oriented Specifications

Abstract

Abstract. This paper presents an approach to specify and check discretionary information flow properties of concurrent systems. The approach is inspired by the success of the interaction-oriented paradigm to concurrent systems (cf. choreographies, behavioural types, protocols,...) in providing behavioural guarantees of global properties such as deadlock-absence. We show how some information flow properties are easier to formalise and check on a global interaction-oriented description of a concurrent system rather than on a local process-oriented description of the components of the system. We use a simple choreography description language adapted from the literature of choreographies and session types. We provide a generic method to instrument the semantics with information flow annotations. Policies are used to specify the admissible flows of information. The main contribution of the paper is a sound type system for statically checking if a system specification ensures an information flow policy. The approach is illustrated with two archetypal examples of distributed and parallel computing systems: a protocol for an identity-secured data providing service and a parallel MapReduce computation.

A Survey of Multitier Programming

“…Choreographic programming's formal foundations are rooted in process calculi [9]. It has been used to investigate new techniques on information flow control [85], deadlock-free distributed algorithms [37] and protocols for dynamic run time code updates for components [107]. Role parameters in the choreographic language Choral [52] recall ScalaLoci's abstract peer types [143]: They can be freely instantiated with different arguments, further allowing for components to dynamically switch the roles in the distributed system at run time.…”

A Core Model for Choreographic Programming

“…For these, CC is a representative model that can be used as foundations to start from. For other kinds of analyses, like information flow in choreographies (Lluch Lafuente et al, 2015), selections are not strictly necessary and MC may be the better choice. Similar considerations apply to monitoring, since typically that involves checking whether the actions performed by a choreographed system respect some specifications: if the specifications contain information about explicit choice communications, then selections are necessary (CC), otherwise MC may offer a simpler base model.…”

Certifying Choreography Compilation

“…The potential of choreographic programming has motivated the study of choreographic languages and EPP definitions for different applications, including self-adaptive systems [14], information flow [20], system integration [15], parallel algorithms [9], cyber-physical systems [16,21,22], and security protocols [16].…”