Securing Interactive Programs

Abstract

This paper studies the foundations of informationflow security for interactive programs. Previous research assumes that the environment is total, that is, it must always be ready to feed new inputs into programs. However, programs secure under this assumption can leak the presence of input. Such leaks can be magnified to whole-secret leaks in the concurrent setting. We propose a framework that generalizes previous research along two dimensions: first, the framework breaks away from the totality of the environment and, second, the framework features fine-grained security types for communication channels, where we distinguish between the security level of message presence and message content. We show that the generalized framework features appealing compositionality properties: parallel composition of secure program results in a secure thread pool. We also show that modeling environments as strategies leads to strong compositionality: various types of composition (with and without scoping) follow from our general compositionality result. Further, we propose a type system that supports enforcement of security via fine-grained security types.

Precise enforcement of progress-sensitive security

“…The enforcement mechanism of Boudol [10], is, similarly to our approach, parametrized over a class of terminating programs, but unlike our work, it does not take runtime information into account; moreover, nonterminating programs are ruled out. Type systems of [48,11,41] enforce progress-sensitivity by permitting high loops but disallowing public side effects after that; this is similar to what one achieves in our language without cast command.…”

Non-interference with What-Declassification in Component-Based Systems

“…An LTS p produces t under ω, written ω |= p t − → if ω is consistent with t and p t − →. Again, this definition of strategies is a generalization of the previous work in [3].…”

“…Our framework is an extension of the framework by Rafnsson et al [3]. Our notion of declassification has as a consequence that non-interference in presence of deterministic environments is weaker than non-interference in general.…”

“…Our notion of declassification has as a consequence that non-interference in presence of deterministic environments is weaker than non-interference in general. Since equivalence of non-interference with deterministic environments and noninterference in general is the basis for compositionality proofs in [3], we provide a compositionality proof for non-interference with declassification. We provide a formalization of components as sets of services operating on separated states making assumptions on the environment the component is executed in.…”

“…In related work [3] this restricted form of an LTS is called "input-output LTS". For simplicity, we directly refer to them as LTS in the remainder.…”