Abstract

With the variables of a program classified as L (low, public) or H (high, private), we wish to prevent the program from leaking information about H variables into L variables. Given a multi-threaded imperative language with probabilistic scheduling, the goal can be formalized as a property called probabilistic noninterference. Previous work identified a type system sufficient to guarantee probabilistic noninterference, but at the cost of severe restrictions: to prevent timing leaks, H variables were disallowed from the guards of while loops. Here we present a new type system that gives each command a type of the form 1 cmd 2 ; this type says that the command assigns only to variables of level 1 (or higher) and has running time that depends only on variables of level 2 (or lower). Also we use types of the form cmd n for commands that terminate in exactly n steps. With these typings, we can prevent timing leaks by demanding that no assignment to an L variable may sequentially follow a command whose running time depends on H variables. As a result, we can use H variables more flexibly; for example, under the new system a thread that involves only H variables is always well typed. The soundness of the type system is proved using the notion of probabilistic bisimulation.

Citations

1577	An Introduction to Probability Theory and Its Applications Volume I. 3rd edition - Feller - 1968
348	Certification of programs for secure information flow - Denning, Denning - 1977
127	Transforming out timing leaks - Agat - 2000
73	Interactive Markov Chains - Hermanns - 1998
46	Secure information flow as typed process behaviour - Honda, Vasconcelos, et al. - 2000
17	Type Based Techniques for Covert Channel Elimination and Register Allocation - Agat - 2000