Information flow inference for ML.pdf

Information Flow Inference for ML Vincent Simonet INRIA Rocquencourt – Projet Cristal MIMOSA September 27, 2001 Information flow account number %%LL LLL LLL LLL LLL LLL L bank applet yyyyyyyyyyy E EE EE EE EE EE order 99rrrrrrrrrrrrrrrrrr vendor accountH × orderL→ bankH × vendorL (?αβγδ) [α t β ≤ γ, β ≤ δ] accountα × orderβ→ bankγ × vendorδ MIMOSA September 27, 2001 Information Flow Inference for ML (Vincent Simonet) 1 Non-interference account number %%LL LLL LLL LLL LLL LLL L %%LL LLL LLL LLL LLL LLL L bank applet  EE EE EE EE EE E yyyyyyyyyyy yyyyyyyyyyy order 5=rrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrr vendor MIMOSA September 27, 2001 Information Flow Inference for ML (Vincent Simonet) 2 Existing systems Dennis Volpano et Geoffrey Smith (1997) Type system on a simple imperative langage. Restricted to the first order and a finite number of global references. Nevin Heintze et Jon G. Riecke SLam Calculus (1997) λ-calculus with references and threads. The typing of mutable cells is not fine enough. No security property is stated. Andrew C. Myers JFlow (1999) Information flow analysis for Java. This sytem is complex and not proven. Steve Zdancewic et Andrew C. Myers (2001) Analysis on a low-level language with linear continuations. MIMOSA September 27, 2001 Information Flow Inference for ML (Vincent Simonet) 3 The ML language Call-by-value λ-calculus with let-polymorphism x k fun x→ e e1 e2 let x = v in e bind x = e1 in e2 with references ref e e1 := e2 ! e and exceptions ε e raise e e1 handle ε x  e2 e1 handle x  e2 MIMOSA September 27, 2001 Information Flow Inference for ML (Vincent Simonet) 4 The ML language v-normal forms v ::= x | k | fun x→ e | ε v e ::= v v | ref v | v := v |! v | raise v | let x = v in e | E[v] E ::= bind x = [ ] in e | [ ] handle ε x  e | [ ] handle x  e Any source expression may be rewritten into a v-normal form provided an evaluation strategy is fixed : e1 e2 ? { bind x1 = e1 in (bind x2 = e2 in x1 x2) left to right eval. bind x2 = e2 in (