The lattice model proposed by Denning in her seminal work provided secure information flow analyses with an intuitive and uniform mathematical foundation. Different organisations, however, may employ quite different security lattices. In this paper, we propose a connection framework that permits different organisations to exchange information while maintaining both security of information flows as well as their autonomy in formulating and maintaining security policy. Our prescriptive framework is based on the rigorous mathematical framework of Lagois connections given by Melton, together with a simple operational model for transferring object data between domains. The merit of this formulation is that it is simple, minimal, adaptable and intuitive, and provides a formal framework for establishing secure information flow across autonomous interacting organisations. We show that our framework is semantically sound, by proving that the connections proposed preserve standard correctness notions such as non-interference.
The notion of Lagois connections @cite_19 has surprisingly not been employed much in computer science. The only cited use of this idea seems to be the work of Huth @cite_4 in establishing the correctness of programming language implementations. To our knowledge, our work is the only one to propose their use in secure information flow control.
@cite_19 @cite_4
2057856707 2017639917 1803857739 2202148857
Abstract In this paper we define a Lagois connection, which is a generalization of a special type of Galois connection. We begin by introducing two examples of Lagois connections. We then recall the definition of Galois connection and some of its properties; next we define Lagois connection, establish some of its properties, and compare these with properties of Galois connections; and then we (further) develop examples of Lagois connections. Via these examples it is shown that, as is the case of Galois connections, there is a plethora of Lagois connections. Also it is shown that several fundamental situations in computer science and mathematics that cannot be interpreted in terms of Galois connections naturally fit into the theory of Lagois connections. Starting from the seminal work of Volpano and Smith, there has been growing evidence that type systems may be used to enforce confidentiality of programs through non-interference. However, most type systems operate on high-level languages and calculi, and ''low-level languages have not received much attention in studies of secure information flow'' (Sabelfeld and Myers, [Language-based information-flow security. IEEE Journal on Selected Areas in Communications 2003; 21:5-19]). Therefore, we introduce an information flow type system for a low-level language featuring jumps and calls, and show that the type system enforces termination-insensitive non-interference. Furthermore, information flow type systems for low-level languages should appropriately relate to their counterparts for high-level languages. Therefore, we introduce a compiler from a high-level imperative programming language to our low-level language, and show that the compiler preserves information flow types. We study frameworks for the equivalence of abstract state-transition systems represented as posets. A basic notion of equivalence is proposed. A least fix-point operator transforms basic equivalences into strong equivalences (=Lagois Connections) which makes Lagois Connections into a category. In the absence of divergence, the two notions of equivalence coincide. We generalize these notions by adding a logical level to express divergence more precisely. Then both generalized notions of equivalence coincide even in the presence of divergence. We present an approach for dynamic information flow control across the application and database. Our approach reduces the amount of policy code required, yields formal guarantees across the application and database, works with existing relational database implementations, and scales for realistic applications. In this paper, we present a programming model that factors out information flow policies from application code and database queries, a dynamic semantics for the underlying @math core language, and proofs of termination-insensitive non-interference and policy compliance for the semantics. We implement these ideas in Jacqueline, a Python web framework, and demonstrate feasibility through three application case studies: a course manager, a health record system, and a conference management system used to run an academic workshop. We show that in comparison to traditional applications with hand-coded policy checks, Jacqueline applications have 1) a smaller trusted computing base, 2) fewer lines of policy code, and 2) reasonable, often negligible, additional overheads.