Secure contexts for confidential data

Information flow security in a multilevel system aims at guaranteeing that no high level information is revealed to low level users, even in the presence of any possible malicious process. This requirement could be too demanding when some knowledge about the environment (context) in which the process is going to run is available. To deal with these simulations we introduce the notion of secure contexts for a class of processes. This notion is parametric with respect to both the observation equivalence and the operation used to characterize the low level behavior of a process. We mainly analyze the cases of bisimulation and trace equivalence. We describe how to build secure contexts in these cases and we show that two well-known security properties, named BNDC and NDC, are just special instances of our general notion.

1. Introduction

The problem of protecting confidential data in a multilevel system is one of the relevant issues in computer security. Information flow security aims at guaranteeing that no high level (confidential) information is revealed to users running at low levels [8], [14], [5], [17], [22], [20], even in the presence of any possible malicious process. An early attempt to formalize the absence of information flow was the concept of noninterference proposed in the seminal paper by Goguen and Meseguer [9], and further developed in [5], [6], [3], [11], [18], [21], [10]. Intuitively, to establish that information does not flow from high to low it is sufficient to establish that high behavior has no effect on what low level users can observe, i.e., the low level view of the system is independent of high behavior. A process which is secure with respect to this notion is thus secure whatever the surrounding high level environment is.