Simple Noninterference by Normalization
Paper in proceedings, 2019

Information-flow control (IFC) languages ensure programs preserve the confidentiality of sensitive data. Noninterference, the desired security property of such languages, states that public outputs of programs must not depend on sensitive inputs. In this paper, we show that noninterference can be proved using normalization. Unlike arbitrary terms, normal forms of programs are well-principled and obey useful syntactic properties-hence enabling a simpler proof of noninterference. Since our proof is syntax-directed, it offers an appealing alternative to traditional semantic based techniques to prove noninterference.

In particular, we prove noninterference for a static IFC calculus, based on Haskell's seclib library, using normalization. Our proof follows by straightforward induction on the structure of normal forms. We implement normalization using normalization by evaluation and prove that the generated normal forms preserve semantics. Our results have been verified in the Agda proof assistant.

information-flow control

normalization by evaluation

noninterference

Author

Carlos Tomé Cortiñas

Chalmers, Computer Science and Engineering (Chalmers), Information Security

Nachiappan Valliappan

Chalmers, Computer Science and Engineering (Chalmers), Information Security

Proceedings of the 14th ACM SIGSAC Workshop on Programming Languages and Analysis for Security

61-72

Workshop on Programming Languages and Analysis for Security (PLAS)
, ,

Octopi: Säker Programering för Sakernas Internet

Swedish Foundation for Strategic Research (SSF), 2018-03-01 -- 2023-02-28.

WebSec: Securing Web-driven Systems

Swedish Foundation for Strategic Research (SSF), 2018-03-01 -- 2023-02-28.

Subject Categories

Other Computer and Information Science

Language Technology (Computational Linguistics)

Computer Science

DOI

10.1145/3338504.3357342

More information

Latest update

12/19/2019