On the refinement of non-interference

Graham-Cumming, John; Sanders, J. W.

doi:10.1109/csfw.1991.151567

Cited by 25 publications

(26 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A detailed comparison between NDC-like properties and the notions proposed in [22] can be found in [3]. Paper [9], similarly to our work and [14], requires that refinement preserves some relations between processes. However, differently from what we do, only traces are considered.…”

Section: Conclusion and Related Workmentioning

confidence: 76%

See 1 more Smart Citation

Refinement operators and information flow security

Bossi

Focardi

Piazza

et al. 2003

First International Conference onSoftware Engineering and Formal Methods, 2003.Proceedings.

View full text Add to dashboard Cite

The systematic development of complex systems usually relies on a stepwise refinement procedure from an abstract specification to a more concrete one, that can finally be implemented. The use of refinement operators preserving system properties is clearly essential since it avoids properties to be re-investigated at each development step.In this paper we formalize the notion of refinement for processes described as terms of the Security Process Algebra (SPA). We consider several information flow security properties and provide sufficient conditions under which our refinement operators preserve such security properties. Finally, we study how refinements can be composed still preserving the security of the system.

show abstract

Section: Conclusion and Related Workmentioning

confidence: 76%

“…Other important works on refining non-interference are [11,21,22,9]. As observed in [14], in [11] it is given a method for making a specification secure after it has been sufficiently refined.…”

Section: Conclusion and Related Workmentioning

confidence: 99%

Refinement operators and information flow security

Bossi

Focardi

Piazza

et al. 2003

First International Conference onSoftware Engineering and Formal Methods, 2003.Proceedings.

View full text Add to dashboard Cite

show abstract

“…The first two conjuncts of the consequent follow from arguments analogous to those used above for assertions (10) and (11). The third and fourth conjunct can be established by trace induction.…”

Section: Discussionmentioning

confidence: 99%

“…For each assertion the base case where T=[] is analogous to the arguments given for assertions (10) and (11). Also for each assertion if we assume the assertion holds for T, then it holds for T.PUSH(u,s,x), T.POP(u,s), and T.TOP(u,s) by analogous arguments.…”

Section: Appendixmentioning

confidence: 99%

Proving Noninterference and Functional Correctness Using Traces

McLean¹

1992

View full text Add to dashboard Cite

The trace method of software specification is extended to provide a natural semantics for a procedural programming language. This extension provides a method for proving program correctness that permits a direct proof of program Noninterference without having to produce an intermediate finite state machine and unwinding conditions. This approach provides a uniform framework for reasoning about abstract software system specifications and their implementations. It also allows us to prove security at an abstract level so that changes to programs that do not affect functional behavior will not affect the security proof.

show abstract

“…Graham-Cumming & Sanders [12] used the unwinding theorem [13][15] to describe refinement of a system such that noninterference between users in an abstract specification of the system could be preserved through more concrete representations of the system, however the results of this work were limited to noninterference, and were not extensible to more general security policies or confidentiality rules, such as those for covert channels. Enforcement of a range of security properties is possible in our approach through the use of security assertions that are explicitly checked during Alloy program analysis.…”

Section: Related Workmentioning

confidence: 99%

A security domain model to assess software for exploitable covert channels

Shaffer

Auguston

Irvine

et al. 2008

Proceedings of the Third ACM SIGPLAN Workshop on Programming Languages and Analysis for Security

View full text Add to dashboard Cite

Covert channels can result in unauthorized information flows when exploited by malicious software. To address this problem, we present a precise, formal definition for covert channels, which relies on control flow dependency tracing through program execution, and extends Dennings' and subsequent classic work in secure information flow [9][40] [30]. A formal security Domain Model (DM) for conducting static analysis of programs to identify covert channel vulnerabilities is described. The DM is comprised of an Invariant Model, which defines the generic concepts of program state, information flow, and covert channel rules; and an Implementation Model, which specifies the behavior of a target program. The DM is compiled from a representation of the program, written in a domain-specific Implementation Modeling Language (IML), and a specification of the security policy written in Alloy. The Alloy Analyzer tool is used to perform static analysis of the DM to automatically detect potential covert channel vulnerabilities and security policy violations in the target program.

show abstract

On the refinement of non-interference

Cited by 25 publications

References 5 publications

Refinement operators and information flow security

Refinement operators and information flow security

Proving Noninterference and Functional Correctness Using Traces

A security domain model to assess software for exploitable covert channels

Contact Info

Product

Resources

About