UR presents paper on Hydra security policy
When a computer program requires legitimate access to confidential data, the question arises whether such a program may illegally reveal sensitive information. The paper proposes a policy model to specify what information flow is permitted in a computational system.
The security definition, which is based on a general notion of information lattices, allows various representations of information to be used in the enforcement of secure information flow in terministic or nondeterministic systems. A flexible semantics-based analysis technique is presented, which uses the input-output relational model induced by an attacker’s observational power, to compute the information released by the computational system.
The full paper can be read here.
The security definition, which is based on a general notion of information lattices, allows various representations of information to be used in the enforcement of secure information flow in terministic or nondeterministic systems. A flexible semantics-based analysis technique is presented, which uses the input-output relational model induced by an attacker’s observational power, to compute the information released by the computational system.
The full paper can be read here.