From Exponential to Polynomial-Time Security Typing via Principal Types

Abstract

Abstract. Hunt and Sands (POPL'06) studied a flow sensitive type (FST) system for multi-level security, parametric in the choice of lattice of security levels. Choosing the powerset of program variables as the security lattice yields a system which was shown to be equivalent to Amtoft and Banerjee's Hoare-style independence logic (SAS'04). Moreover, using the powerset lattice, it was shown how to derive a principal type from which all other types (for all choices of lattice) can be simply derived. Both of these earlier works gave "algorithmic" formulations of the type system/program logic, but both algorithms are of exponential complexity due to the iterative typing of While loops. Later work by Hunt and Sands (ESOP'08) adapted the FST system to provide an erasure type system which determines whether some input is correctly erased at a designated time. This type system is inherently exponential, requiring a double typing of the erasure-labelled input command. In this paper we start by developing the FST work in two key ways: (1) We specialise the FST system to a form which only derives principal types; the resulting type system has a simple algorithmic reading, yielding principal security types in polynomial time. (2) We show how the FST system can be simply extended to check for various degrees of termination sensitivity (the original FST system is completely termination insensitive, while the erasure type system is fully termination sensitive). We go on to demonstrate the power of these techniques by combining them to develop a type system which is shown to correctly implement erasure typing in polynomial time. Principality is used in an essential way to reduce type derivation size from exponential to linear.

Very Static Enforcement of Dynamic Policies

“…We extended the flow-sensitive type system from [HS06] to provide for each output channel individual dependency sets per point in the program and demonstrated that this is sufficient to support dynamic information flow policies. We proved the type system sound with respect to a straightforward two-run property which we showed sufficient to imply knowledge-based security conditions.…”

“…The original work of [HS06] defines a family of type systems, parameterised by choice of a multi-level security lattice, and establishes the existence of principal typings within this family. The later work of [HS11] defines a single system which produces only principal types.…”

On Information Flow Control in Event-B and Refinement

“…The flow-sensitive types system was defined by a family of inference systems which is forced to satisfy a simple non-interference property. Their recent work [9] showed how flow-sensitive multi-level security typing can be achieved in polynomial time. In addition to type-based treatments of secure information flow analysis for programs, Clark et.…”

Hypercollecting semantics and its application to static analysis of information flow

“…We rely on abstract interpretation to derive a static analysis similar to existing ones inferring dependences (Amtoft and Banerjee 2004;Hunt and Sands 2006;Amtoft et al 2006;Hunt and Sands 2011). Recall that our analyses are parametrised on a security lattice L and program P. We denote by l ; x an atomic dependence constraint, with l ∈ L and x ∈ VarP, read as "agreement up to security level l leads to agreement on x".…”