A Dependently Typed Library for Static Information-Flow Control in Idris

Abstract

Safely integrating third-party code in applications while protecting the confidentiality of information is a long-standing problem. Pure functional programming languages, like Haskell, make it possible to enforce lightweight information-flow control through libraries like MAC by Russo. This work presents DepSec, a MAC inspired, dependently typed library for static information-flow control in Idris. We showcase how adding dependent types increases the expressiveness of state-of-the-art static information-flow control libraries and how DepSec matches a special-purpose dependent information-flow type system on a key example. Finally, we show novel and powerful means of specifying statically enforced declassification policies using dependent types.

Mechanized logical relations for termination-insensitive noninterference

“…This is impractical for realistic settings where resources, such as the heap, can be shared. To address this issue, some recent information-flow systems [Gregersen et al 2019;Lourenço and Caires 2015;Murray et al 2016;Nanevski et al 2011;Zheng and Myers 2007] support value-dependent classification policies. These policies describe a relationship between two values, such that the value of one decides the classification-level of the other.…”

“…Such systems establish various notions of noninterference [Goguen and Meseguer 1982], conveying that observable aspects of the program's behavior is independent of its sensitive inputs. Information-flow control enforcement is often specified as a static type system (e.g., Abadi et al [1999]; Arden and Myers [2016]; Heintze and Riecke [1998]; Lourenço and Caires [2015]; Myers [1999]; Simonet [2003b]) or via an encoding into an existing type system (e.g., Algehed and Russo [2017]; Gregersen et al [2019]; Li and Zdancewic [2006]; Pottier and Simonet [2003]; Russo [2015]; Russo et al [2008]; Vassena et al [2018]). Modern programming languages have rich type systems featuring, e.g., higher types, reference types, and abstract types, which are all essential for modern software engineering practice and for implementing reusable software components.…”

Static Enforcement of Security in Runtime Systems

“…Rules S-AT and S-DELAY implement simple predictive mitigation of direct timing channels, i.e., channels represented directly in the control-flow of the program: S-AT reduces to the underlying command c, but ensures that the command terminates in exactly n steps, where n is the result of evaluating expression e, by delaying further commands until the command delay n has terminated. 9 The semantics of unscope is defined in the Appendix. 10 The complete definition of matching is found in the Appendix.…”

“…The use of existentially quantified labels is introduced by Tse and Zdancewic [36], and we follow the same typing discipline for such values. Dependent type systems for IFC has also been explored by Lourenço and Caires [16], Zhang et al [43] and Gregersen et al [9].…”