Enforcing Robust Declassification
Paper i proceeding, 2004

Noninterference requires that there is no information flow from sensitive to public data in a given system. However, many systems perform intentional release of sensitive information as part of their correct functioning and therefore violate noninterference. To control information flow while permitting intentional information release, some systems have a downgrading or declassification mechanism. A major danger of such a mechanism is that it may cause unintentional information release. This paper shows that a robustness property can be used to characterize programs in which declassification mechanisms cannot be exploited by attackers to release more information than intended. It describes a simple way to provably enforce this robustness property through a type-based compile-time program analysis. The paper also presents a generalization of robustness that supports upgrading (endorsing) data integrity.


security-type systems

security policies

information flow


Computer security



Andrew Myers

Andrei Sabelfeld

Chalmers, Institutionen för datavetenskap, ProSec

Steve Zdancewic

Proceedings of the 17th IEEE Computer Security Foundations Workshop / edited by Riccardo Focardi

1063-6900 (ISSN)



Data- och informationsvetenskap

Mer information