Unifying Facets of Information Integrity

Abstract

Abstract. Information integrity is a vital security property in a variety of applications. However, there is more than one facet to integrity: interpretations of integrity in different contexts include integrity via information flow, where the key is that trusted output is independent from untrusted input, and integrity via invariance, where the key is preservation of an invariant. Furthermore, integrity via invariance is itself multi-faceted. For example, the literature features formalizations of invariance as predicate preservation (predicate invariance), which is not directly compatible with invariance of memory values (value invariance). This paper offers a unified framework for integrity policies that include all of the facets above. Despite the different nature of these facets, we show that a straightforward enforcement mechanism adapted from the literature is readily available for enforcing all of the integrity facets at once.

A Principled Approach to Tracking Information Flow in the Presence of Libraries

“…The labels, , are taken from a two-point upper semi-lattice L Ď H, where L denotes low ("public" when modeling confidentiality or "trusted" when modeling integrity) and H denotes high ("secret" when modeling confidentiality or "untrusted" when modeling integrity). While we focus on confidentiality throughout the paper, information flow integrity can be modeled dually [5].v ::" n v ::" n For labels let 1 \ 2 denote the least upper bound of 1 and 2 , and letv…”

Contingency Revisited: Secure Construction and Legal Implications of Verifiably Weak Integrity

“…The opposite of integrity is often found to be defined differently, e.g. in the information flow community the opposite is confidentiality [5].…”

“…Judges have ruled in favor of lying women 4 and thereby removed any negative consequences that arose from untruthfully answers to that question. 5 Following this legal motivation a technical system should allow the user to not always produce integrity protected data. For the pregnancy example Rost and Pfitzmann state that often technical systems are designed to always answer correctly, e.g., would extract the information about a known pregnancy from the woman's electronic patient record.…”

Capabilities for information flow

“…the original program While the above corollary states transparency with respect to the monitor, most useful is the transparency with respect to the original program. Because the only possibility of affecting the semantics by the monitor is by blocking execution, it is straightforward to show (e.g., [5]) that the monitored execution, when it terminates, does not alter the program semantics. It then follows directly that if a transformed program terminates, it must preserve the semantics of the original program as well.…”