Simple noninterference from parametricity

Abstract

In this paper we revisit the connection between parametricity and noninterference. Our primary contribution is a proof of noninterference for a polyvariant variation of the Dependency Core Calculus of Abadi et al. in the Calculus of Constructions. The proof is modular: it leverages parametricity for the Calculus of Constructionsand the encoding of data abstraction using existential types.This perspective gives rise to simple and understandable proofs of noninterference from parametricity. All our contributions have been mechanised in the Agda proof assistant.

Mechanized logical relations for termination-insensitive noninterference

“…Based on previous work of Tse and Zdancewic [2004], Bowman and Ahmed [2015] provide a translation from the recursion-free fragment of DCC to , translating noninterference into parametricity. Algehed and Bernardy [2019] leverage parametricity of the Calculus of Constructions to prove noninterference for a polyvariant variation of DCC and Algehed et al [2020] show noninterference of a dynamic information-flow control library using a parametricity theorem. All these works model information-flow properties using parametricity whereas we add impredicative type polymorphism to a security-typed language.…”

A unified view of modalities in type systems

“…Supporting security features via generic abstraction features of type systems have been proposed before, but so far this has been done via quantification over types [Bowman and Ahmed 2015; Tse and Zdancewic 2004]. It has additionally been shown that non-interference is a consequence of the generic parametricity of type-theory [Algehed and Bernardy 2019].…”

Giving Semantics to Program-Counter Labels via Secure Effects

“…Formally, the protection relation defines the label of data, leading to the following theorem. Bowman and Ahmed [2015] proved the version we use here and Algehed and Bernardy [2019] provided a machine-checked proof in Agda.…”

“…Theorem 1 (Noninterference for DCC [Algehed and Bernardy 2019;Bowman and Ahmed 2015]). For expressions 𝑒 1 and 𝑒 2 and ℓ ∈ L, if Γ ⊢ 𝑒 1 : 𝜏, Γ ⊢ 𝑒 2 : 𝜏, and ℓ ⊳ 𝜏, then for all labels ℓ Atk ∈ L, either ℓ ⊑ ℓ Atk or 𝑒 1 ≈ ℓ Atk 𝑒 2 .…”

“…While DCC with the call-by-value semantics we are using enforces termination-insensitive noninterference [Abadi et al 1999;Algehed and Bernardy 2019;Bowman and Ahmed 2015;Heintze and Riecke 1998], termination channels can leak arbitrary amounts of data [Askarov et al 2008]. We would therefore like to remove the strong assumption that attackers cannot use those channels.…”