A Comparison of Semantic Models for Noninterference

Abstract

The literature on definitions of security based on causality-like notions such as noninterference has used several distinct semantic models for systems. Early work was based on state-machine and trace-set definitions; more recent work has dealt with definitions of security in two distinct process algebraic settings. Comparisons between the definitions has been carried out mainly within semantic frameworks. This paper studies the relationship between semantic frameworks, by defining mappings between a number of semantic models and studying the relationship between notions of noninterference under these mappings.

Analysis and Proofs of Properties in Intransitive Noninterference

“…(See [12] for a comparison and a discussion of their relationships. )We work here with the state-observed machine model used by Rushby [2] In the definition of TA-secure, the operational model of information flow given by the function $ta$ permits a domain to trnsmit information that it may have, even if it has never observed anything from which it could deduce that information.…”

Intransitive noninterference in nondeterministic systems

“…It is shown in [23] that, in the special case of deterministic systems, the lazy abstraction approach corresponds to the application of the purge function of NI to nondeterministic systems, and the mixed abstraction approach corresponds to a notion of security van der Meyden calls ITO-security: this differs from TA security in that it uses functions that are like tau, but which track information about observations as well as information about actions. Thus, both definitions differ from the TA-based definitions we have presented.…”

Architectural Refinement and Notions of Intransitive Noninterference

“…We remark that under certain circumstances, the definitions given by Roscoe and Goldsmith [RG99] correspond either to P-security or to ITO-security-see [Mey07] for details. The following result shows how these definitions are related:…”

“…Moreover, TA-security can be shown [Mey08] to correspond in a precise sense to Rushby's "unwinding" proof technique for intransitive noninterference. We remark that under certain circumstances, the definitions given by Roscoe and Goldsmith [RG99] correspond either to P-security or to ITO-security-for details, we refer the reader to [Mey07], which is concerned with a detailed comparison of the above definitions of security in a number of different semantic frameworks.…”