Simple Noninterference by Normalization
Paper i proceeding, 2019

Information-flow control (IFC) languages ensure programs preserve the confidentiality of sensitive data. Noninterference, the desired security property of such languages, states that public outputs of programs must not depend on sensitive inputs. In this paper, we show that noninterference can be proved using normalization. Unlike arbitrary terms, normal forms of programs are well-principled and obey useful syntactic properties-hence enabling a simpler proof of noninterference. Since our proof is syntax-directed, it offers an appealing alternative to traditional semantic based techniques to prove noninterference.

In particular, we prove noninterference for a static IFC calculus, based on Haskell's seclib library, using normalization. Our proof follows by straightforward induction on the structure of normal forms. We implement normalization using normalization by evaluation and prove that the generated normal forms preserve semantics. Our results have been verified in the Agda proof assistant.

information-flow control

normalization by evaluation

noninterference

Författare

Carlos Tomé Cortiñas

Chalmers, Data- och informationsteknik, Informationssäkerhet

Nachiappan Valliappan

Chalmers, Data- och informationsteknik, Informationssäkerhet

Proceedings of the 14th ACM SIGSAC Workshop on Programming Languages and Analysis for Security

61-72

Workshop on Programming Languages and Analysis for Security (PLAS)
, ,

Octopi: Säker Programering för Sakernas Internet

Stiftelsen för Strategisk forskning (SSF), 2018-03-01 -- 2023-02-28.

WebSec: Säkerhet i webb-drivna system

Stiftelsen för Strategisk forskning (SSF), 2018-03-01 -- 2023-02-28.

Ämneskategorier

Annan data- och informationsvetenskap

Språkteknologi (språkvetenskaplig databehandling)

Datavetenskap (datalogi)

DOI

10.1145/3338504.3357342

Mer information

Senast uppdaterat

2019-12-19