Preserving confidentiality while reacting on iterated queries and belief revisions

Confidentiality enforcement by hybrid control of information flows

“…With our focus on such a unified control, we used an abstract representation of information like in [7] for the purpose of flow tracking in task ( 2), but for future instantiations of our framework we could use a logic-based representation of the temporary views and the observer's previous view. In this case, the confidentiality policy could be stated more conveniently as a set of logical sentences and Asumption 2 can be established by results on view computations for particular basic information requests, including queries to relational databases or incomplete databases, updates, see the summaries [5,6] and revisions [10]. Such requests can be jointly offered by information mediation, to be integrated into our framework as outlined in [9].…”

“…This level inference starts with the basic set Γ, which assigns levels from {high, low} to selected expressions, and inductively derives levels of further expressions, including program variables, and levels of assignments as elementary programs and of their composition to complex subprograms by control flow constructs. Our approach is not to select a specific security level high variables each seen as a container for a basic information reaction Components of the proposed framework with a two layered approach according to the draft in [10]: Release of information from the abstract information state to the partner solely through declassification, and control of the information flow through declassification for confidentiality policy compliance by a dynamic monitor which consists of FlowTracker and CIECensor inference system 1 , but to point to properties needed for the verification of our framework and offered by numerous such systems to-date. Each time we eventually instantiate the framework, we select the security level inference system as we demonstrate in Section 3.1.…”

“…Based on Assumption 2 (Temporay view initialization) and Property 2 (Gradual release), we can show by induction on the tree structure that for all nodes n of T the domain of symb(n) is Hvars for (9) and it holds eval(expr)(mem n , ais) = v iff ais ∈ B v ∈ eval(symexpr)(tempvs, mem low ). Since this way we can verify correctness for the translation of all relevant operations of the tree along a path, including branch conditions, we can show correctness of the translation of the complete tree for (10).…”

Constructing Inference-Proof Belief Mediators

“…The framework applies language-based information flow control with declassification supported by controlled interaction execution. Rather than establishing a single inference control mechanism for a specific interaction protocol programmed in Java, as done in previous work, e.g., [8], we more ambitiously aim at providing a general framework to implement any inferenceproof interaction protocol of the kind described in Subsection 3.2. The main goal of the framework is to uniformly and securely relate CIE-like inference control regarding logically expressed pieces of belief on the one hand to information flow control regarding data objects stored in containers and manipulated by means of Java commands like evaluation of expressions, assignment and procedure call, or conditionals (guarded commands) on the other hand.…”

A Commonsense Theory of Secrets

“…As far as we know, studies of secrecy, within the logical tradition, are confined to issues related to system security [5,6,7,8,9,10,11,12,13,14]. In such studies, a secret is presented as a true piece of information about an agent/a system which is not known by a certain adversary group; the focus is mostly on identifying effective, and often subtle, methods for keeping the secret.…”