Non-interference properties for nondeterministic processes

ion of the secure process P in example 3.2, so this abstraction cannot distinguish between some secure and insecure processes. As well as being invisible to the low-level user the actions in H are under the control of the high-level user. We cannot rely on the high-level user always being willing to communicate; the high-level user being free to choose whether to communicate, as well as what to communicate. The eager abstraction is therefore not su cient for our needs. If we allow the high-level user to choose which events to refuse, and hence remove this eagerness to communicate, we can formulate a lazy abstraction. De nition 3.4 Lazy abstraction (failures-divergences model) If P is a divergence-free process, the projection of P into the alphabet L is the divergence-free process P j L with failure-set f(s n H;X) j (s;X \ L) 2 failures(P )g. The lazy abstraction (for the failures-divergences model) LL(P ) is de ned to be P j L. Lazy abstraction ensures every subset of the high-level actions can be refused before the hiding occurs, without introducing divergence if there is unbounded high-level behaviour. The high-level user's actions should not interfere with the low-level user, so it is necessary that the low-level user's view of the system cannot be altered by the occurrence of events in H. For a deterministic process this can be speci ed by saying the low-level abstracted view of the system is deterministic. Since internal actions in this abstraction can be considered as under the control of the high-level user, a deterministic abstraction implies no behaviours of the high-level user can e ect the low-level user. De nition 3.5 Lazily independent (lazily secure) Let P be a non-divergent, nitely nondeterministic and p-free process. P is said to be lazily independent in L, written LINDL(P ) if and only if LL(P ) is deterministic. Suppose that LINDL(P ) holds. For any divergence-free processQ whose alphabet is H we get, since LL(P ) is deterministic it is equivalent to LL(P j[H ]jQ). Example 3.6 The lazy abstractions P 0 and Q0 of the processes de ned in examples 3.2 and 3.3 are P 0 = (a! P 0 2 b! P 0) u (a! P 0 2 b! P 0) Q0 = STOP u (a! Q0 2 b! Q0) These processes no longer have the same abstraction. Process P 0 is equivalent to the process R:(a ! R 2 b ! R) that continually o ers the events a and b to the low-level user. Process Q0 can continually o er a and b events, but after any number of them it can nondeterministically choose to stop. 5 Process P satis es the lazily secure condition, since P 0 is deterministic, and this is a process we would like to think of as secure. The nondeterministic behaviour of Q0 means process Q is not lazily secure, and this is a process we have argued as being insecure. In the original treatment a lazy abstraction was produced by obfuscating the process; interleaving P with RUNH . This made H actions ambiguous, which e ectively imitated actions being delayed. The occurrence of an action h 2 H might be indicating a high-level action taking the system to a new state, or a `false' event / delay, returning the system to an equivalent state. A nondivergent, deterministic processes was said to be lazily secure if this abstraction, P jjj RUNH , was deterministic. There are two main disadvantages to the older abstraction when looking at security. Firstly it cannot be said to be how the low-level user observes the system since all of the process's H events, as well as those introduced by RUNH are visible. Secondly the additional transitions produce a much larger system for an automatic veri er such as FDR to check, and one that \does not lead itself nearly as well to facilitating compression"[11]. This e ects both the size of the problems that can be dealt with, and the time taken to check them. The interleaving abstraction has the advantage that it is de ned in terms of the standard interleaving operator. FDR implements the jjj operator directly, and can verify whether or not a process is deterministic. Despite producing larger systems than the new abstraction, the interleaving abstraction is therefore the one usually used for automatic veri cation. We can use this abstraction because of the following result [12] : Theorem 3.7 The lazy abstraction LL(P ) is deterministic if and only if P jjj RUNH is deterministic. The given lazy abstraction is for the failures-divergences model, and under di erent models the de nition changes. This is not too surprising since, for example, the in nite traces-failures-divergences model can distinguish more processes than the failures-divergences one. For the in nite traces-failures-divergences model the lazy abstraction is dened as (P k SemiFair(L;H)) n H, where SemiFair(L;H) is a process which allows any nite combinations of L's and H's, can never refuse events in L, and will only allow an in nite number of H events to occur if in nitely many L events occur. Under the stable failures model the lazy abstraction is simply (P k CHAOSH) n H. For a divergence-free, nitely nondeterministic process P , the determinism of the lazy abstractions for the failures-divergences, stable failures, and in nite traces-failures-divergences models can be shown to be equivalent [11]. This is also true of the older abstraction. In other words if we have shown there can be no information ow under one of these models we also know there will be no information ow even if the low-level user is observing the system using one of the alternative models. The conditions based on determinism can be considered too strong, since they only allow processes that appear deterministic to the low-level user to be 6 classed as secure. Nondeterminism in a low-level abstraction need not have been caused by potential high-level behaviours, and hence introduced by the abstraction. There is no reason why a nondeterministic process should not be secure, and there are certainly nondeterministic processes that it would seem reasonable to class as secure. To take an extreme example, any process that just contains low-level actions would seem to be secure. 4. Bisimulation Non Deducibility on Compositions The Bisimulation Non Deducibility on Compositions (BNDC) property was proposed in [2] by Focardi and Gorrieri. It is a security property which tries to deal with nondeterministic processes. The property is based on comparing the low-level user's views of the process for all possible behaviours of the high-level user. A system E is BNDC if for every high-level process a low-level user is unable to distinguish between (E j ) nH and E, two processes being treated as indistinguishable if they are weakly bisimilar. Once again we require the low-level user's view of the system should be una ected by whatever actions the high-level user may take. De nition 4.1 (BNDC) E 2 BNDC, 8 2 EH ; E n H B (E j ) nH . An additional property was proposed in [4] | Strong Bisimulation Strong Nondeterministic Non Interference (SBSNNI). BNDC is di cult to deal with since it requires composition with every high-level process , and no static characterisation is known. SBSNNI was proposed as a su cient condition for BNDC which avoids universal quanti cation. SBSNNI is de ned using a similar property | Bisimulation Strong Nondeterministic Non Interference (BSNNI). A process satis es BSNNI if hiding the H actions is the same as restriction the process from them, and a process satis es SBSNNI if each state satis es the previous property. De nition 4.2 (BSNNI) E 2 BSNNI, E n H B E nH De nition 4.3 (SBSNNI) E 2 SBSNNI, 8E0 such that 9 ;E =) E0 we have E0 2 BSNNI. SBSNNI is strictly stronger than BNDC. In [2] it is proved : Theorem 4.4 SBSNNI BNDC BSNNI. BSNNI is not a su ciently strong security condition, since it cannot detect some deadlocks that can be caused by the high-level user. For example, the deterministic process P = l1 ! P 2 h1 ! h1 ! l1 ! P satis es it, despite preventing L actions immediately after its rst h1 event. BNDC was introduced to try and solve this problem. 7 5. Nondeterministic examples The following nondeterministic examples will be used to demonstrate some subtle information ows. We will consider how the bisimulation non-deducibility conditions treat these systems. Since all the following examples are nondeterministic the lazy abstraction properties are not considered. In each of the following examples H = fh1; h2; : : :g and L = fl1; l2; : : :g. Example 5.1 P = :( :l1:P + h1:l1:P ) + :l2:P