• Summary
• Related Documents
  • Active Bibliography
  • Co-citation
• Version History

Abstract:

Language-based approaches to information security have led to the development of security type systems that permit the programmer to describe condentiality policies on data. Security type systems are usually intended to enforce noninterference, a property that requires that high-security information not aect low-security computation. However, in practice, noninterference is often too restrictive|the desired policy does permit some information leakage. To compensate for the strictness of noninterference, practical approaches include some mechanism for declassifying high-security information. But such declassication is potentially dangerous, and its use should be restricted to prevent unintended information leaks. Zdancewic and Myers previously introduced the notion of robust declassi cation in an attempt to capture the desired restrictions on declassication, but that work did not propose a method for determining when a program satises the robust declassication condition. This paper motivates robust declassication and shows that a simple change to a security type system can enforce it. The idea is to extend the lattice of security labels to include integrity constraints as well as condentiality constraints and then require that the decision to perform a declassication have high integrity. 1

Citations