Copyright © 2007 Elsevier Inc. All rights reserved.
Controlling information release in the π-calculus
Received 15 July 2005;
References and further reading may be available for this article. To view references and further reading you must purchase this article.
Abstract
We introduce a notion of controlled information release for a typed version of the π-calculus extended with declassification primitives; this property scales to noninterference when downgrading is not allowed. We provide various characterizations of controlled release, based on a typed behavioural equivalence relative to a security level σ, which captures the idea of external observers of level σ. First, we define our security property through a universal quantification over all the possible active attackers, i.e., malicious processes which interact with the system possibly leaking secret information. Then we characterize the controlled release property in terms of an unwinding condition, which deals with so-called passive attackers trying to infer confidential information just by observing the behaviour of the system. Furthermore, we express controlled information release in terms of partial equivalence relations (per models, for short) in the style of a stream of similar studies for imperative and multi-threaded languages. We show that the controlled release property is compositional with respect to most operators of the language leading to efficient proof techniques for the verification and the construction of (compositional) secure systems.
Keywords: Process Algebra; Noninterference; Downgrading







E-mail Article
Add to my Quick Links

Cited By in Scopus (0)

{0,1}. We show that the qualitative extended reachability problem is decidable in polynomial time, and that the set of all configurations for which there is a winning strategy is effectively regular. More precisely, this set can be represented by a deterministic finite-state automaton with a fixed number of control states. This result is a generalization of a recent theorem by Etessami and Yannakakis which says that the qualitative termination for 1-exit RMDPs (which exactly correspond to our 




