Access Control and Information Flow in Transactional Memory

Abstract

Abstract. The paper considers the addition of access control to a number of transactional memory implementations, and studies its impact on the information flow security of such systems. Even after the imposition of access control, the Unbounded Transactional Memory due to Ananian et al, and most instances of a general scheme for transactional conflict detection and arbitration due to Scott, are shown to be insecure. This result applies even for a very simple policy prohibiting information flow from a high to a low security domain. The source of the insecurity is identified as the ability of agents to cause aborts of other agents' transactions. A generic implementation is defined, parameterized by a "may-abort" relation that defines which agents may cause aborts of other agents' transactions. This implementation is shown to be secure with respect to an intransitive information flow policy consistent with the access control table and "may-abort" relation. Using this result, Transactional Memory Coherence and Consistency, an implementation due to Hammond et al, is shown to be secure with respect to intransitive information flow policies. Moreover, it is shown how to modify Scott's arbitration policies using the may-abort relation, yielding a class of secure implementations closely related to Scott's scheme.

Security correctness for secure nested transactions

“…Birgisson and Erlingsson in [3] present the semantics and implementation for transactional memory introspection (TMI) that supports the enforcement of security policies in a reflective software transactional memory. Cohen, Meyden and Zuck [4] develop an access control model based on intransitive noninterference [10] to reason about allowable information flows due to access aborts in software transactional memory. These works essentially adapt the work of multilevel databases to software transactional memory.…”