A Multilevel Non-interference Vulnerability Analysis Method for Information Leakage Problem

Security vulnerabilities caused by information leakage are a critical aspect of the security for information systems. Such vulnerabilities can be identified by non-interference analysis. Strong nondeterministic non-interference (SNNI) and bisimulation SNNI (BSNNI) are the typical properties of non-interference. Existing works related to non-interference analysis are mainly based on the setting with only two security levels. Such setting is coarse-grained compared to the real system. In this paper, we analyze the non-interference with multiple security levels by integer linear programming. Obviously, the non-interference with multiple security levels is more fine-grained but more complex than that with only two security levels. On the perspective of complexity, we provide the general and simplified non-interference analyses in turn for multilevel SNNI and BSNNI which are defined on the concepts of upper sets. The general analysis is derived from the definitions of multilevel SNNI and BSNNI, and solve the identification problem of multilevel SNNI and BSNNI directly. By analyzing and removing the impact of upper sets' coverability, the simplified analysis reduces the redundancy and improves the efficiency in the analysis process.