Declassification with Explicit Reference Points

Scheduler-Independent Declassification

“…In order to convince ourselves about the adequacy of our novel security condition, we have checked WHAT&WHERE s against these principles, and we have shown that it satisfies the following prudent principles (based on the formalization of a slightly augmented set of prudent principles in [16]):…”

“…Monotonicity of release [32] Allowing further declassifications for a program that is WHAT&WHERE s -secure cannot render it insecure. Persistence [16] For every program that satisfies WHAT&WHERE s , all programs that are reachable also satisfy this security condition. Relaxation [16] Every program that satisfies noninterference also satisfies WHAT&WHERE s .…”

“…Relaxation [16] Every program that satisfies noninterference also satisfies WHAT&WHERE s . Noninterference up-to [16] Every WHAT&WHERE s -secure program also satisfies noninterference if it were executed in an environment that terminates the program when it is about to perform a declassification.…”

“…For sequential programs, there are solutions addressing the aspects What (e.g., [29,15,16]), Where (e.g., [10,2,11]), and Who (e.g., [25,26,17]) in isolation.…”

Software Security in Virtualized Infrastructures — The Smart Meter Example

“…Information flow control can also guarantee that household appliances cannot be controlled directly by external software, thus protecting safety and integrity of the appliances. Information flow control will guarantee pricavy protection by introducing appropriate security levels for secret, encrypted, aggregated, and public data; analysing the information flow for all such data in the smart meter and the cockpit, and by carefully introducing declassification [30] e.g. at aggregation points.…”