Security type system

In a programming language augmented with a security type system every expression carries both a type (such as boolean, or integer) and a security label.

Following is a simple security type system from ^[1] that enforces non-interference. The notation ${\displaystyle \;\vdash exp\;:\;\tau }$ means that the expression ${\displaystyle exp}$ has type ${\displaystyle \;\tau }$. Similarly, ${\displaystyle [sc]\vdash C}$ means that the command ${\displaystyle C}$ is typable in the security context ${\displaystyle sc}$.

${\displaystyle [E1-2]\quad \vdash exp:high\qquad {\frac {h\notin Vars(exp)}{\vdash exp\;:\;low}}}$

${\displaystyle [C1-3]\quad [sc]\vdash {\textbf {skip}}\qquad [sc]\vdash h\;:=\;exp\qquad {\frac {\vdash exp\;:\;low}{[low]\vdash l\;:=\;exp}}}$

${\displaystyle [C4-5]\quad {\frac {[sc]\vdash C_{1}\quad [sc]\vdash C_{2}}{[sc]\vdash C_{1}\;;\;C_{2}}}\qquad {\frac {\vdash exp\;:\;sc\quad [sc]\vdash C}{[sc]\vdash {\textbf {while}}\ exp\ {\textbf {do}}\ C}}}$

${\displaystyle [C6-7]\quad {\frac {\vdash exp\;:\;sc\quad [sc]\vdash C_{1}\quad [sc]\vdash C_{2}}{[sc]\vdash {\textbf {if}}\ exp\ {\textbf {then}}\ C_{1}\ {\textbf {else}}\ C_{2}}}\qquad {\frac {[high]\vdash C}{[low]\vdash C}}}$

Well-typed commands include, for example,

${\displaystyle [low]\vdash \ {\textbf {if}}\ l=42\ {\textbf {then}}\ h\;:=\;3\ {\textbf {else}}\ l\;:=\;0}$.

Conversely, the program

${\displaystyle l\;:=\;0\$ ;\ {\textbf {while}}\ l<h\ {\textbf {do}}\ l\;:=\;l+1}

is ill-typed, as it will disclose the value of variable ${\displaystyle h}$ into ${\displaystyle l}$.

Note that the rule ${\displaystyle [C7]}$ is a subsumption rule, which means that any command that is of security type ${\displaystyle high}$ can also be ${\displaystyle low}$. For example, ${\displaystyle h:=1}$ can be both ${\displaystyle high}$ and ${\displaystyle low}$. This is called polymorphism in type theory. Similarly, the type of an expression ${\displaystyle exp}$ that satisfies ${\displaystyle h\notin Vars(exp)}$ can be both ${\displaystyle high}$ and ${\displaystyle low}$ according to ${\displaystyle [E1]}$ and ${\displaystyle [E2]}$ respectively.

What

A what declassification policy controls which information (partial or not) may be released to a publicly observable variable.

The following code example shows a declassify construct from.^[8] In this code, the value of the variable h is explicitly allowed by the programmer to flow into the publicly observable variable l.

var l, h
if l = 1 then
    l := declassify(h)

Who

A who declassification policy controls which principals (i.e., who) can access a given piece of information. This kind of policy has been implemented in the Jif compiler.^[9]

The following example allows Bob to share its secret contained in the variable b with Alice through the commonly accessible variable ab.

var ab                                (* {Alice, Bob} *)
var b                                 (* {Bob} *)
if ab = 1 then
    ab := declassify(b, {Alice, Bob}) (* {Alice, Bob} *)

Where

A where declassification policy regulates where the information can be released, for example, by controlling in which lines of the source code information can be released.

The following example makes use of the flow construct proposed in.^[10] This construct takes a flow policy (in this case, variables in H are allowed to flow to variables in L) and a command, which is run under the given flow policy.

var l, h
flow H ${\displaystyle \prec }$ L in
    l := h

When

A when declassification policy regulates when the information can be released. Policies of this kind can be used to verify programs that implement, for example, controlled release of secret information after payment, or encrypted secrets which should not be released in a certain time given polynomial computational power.

Declassification approaches for implicit flows

An implicit flow occurs when code whose conditional execution is based on private information updates a public variable. This is especially problematic when multiple executions are considered since an attacker could leverage the public variable to infer private information by observing how its value changes over time or with the input.

var x, y
y := false
if x = true then
    y := true
return true