## 3 Preliminaries  
### Data Security Concepts  
In classical papers by [PERSON] [12] and [PERSON] [8], which were preceded by the work of [PERSON] [19] and followed by many others concurring with their basic ideas, a concept of _secure information flow_ was introduced, in which data are expected to flow according to the order relations in a lattice of labeled entities. We adapt the basic definitions from this literature as follows: For entities \(x\) and \(y\), we say that there is a _Channel_ from \(x\) to \(y\) if entity \(x\) has permission to write data on \(y\) or entity \(y\) has permission to read data from \(x\), and graphically, we represent this as an arrow from \(x\) to \(y\). Terms such as _receiving_ or _pulling_ can also be used instead of _reading_ and _sending_ or _pushing_ instead of _writing_. The _CanFlow_ or _CF_ relation is defined as the transitive, reflexive closure of the _Channel_ relation and graphically corresponds to directed paths between entities. Any network of entities that are represented as a directed graph in this manner is a _preorder_ that can be reduced to a _partial order_ of equivalence classes of entities, where two entities \(x\) and \(y\) belong to the same equivalence class iff \(CF(x,y)\) and \(CF(y,x)\)[20]. In other words, a set of entities is in the same equivalence class if the data that is in any one of them can reach any other through a directed path; further, the set of the resulting equivalence classes forms a partial order. We define the _label_ of \(x\), \(Lab(x)\), as the set of the names of all entities that can flow to \(x\). So, if \(x\), \(y\), and \(z\) are the names of all entities that can flow to \(w\) beside \(w\) itself, then \(Lab(w)=\{x,y,z,w\}\). Entities in the same equivalence class have the same label. It follows that \(CF(x,y)\)_iff \(Lab(x)\subseteq Lab(y)\)_, and so labels, with the inclusion relation between them, define the flow relation between entities in the partial order. Following the usual terminology in data security theory, we call entity names _categories_, and we note that each category also defines a data _provenance_. Thus, the label of an entity represents the data categories that the entity _can know_. It is important to note that, given a set of reading and writing permissions, as they could be represented in an access control matrix or in a graph, the labels can be computed efficiently by using well-known graph component algorithms [21]. Following [PERSON] [8], we say that the top entities in a partial order, not having any outgoing data flows, have _top secrecy_, while the bottom entities, not having any incoming data flows, have _top integrity_. Top secrecy corresponds to minimum integrity, and vice versa. By extension, entities can be considered to have different levels of secrecy or integrity according to their position in the partial order. In addition, situations of conflict (such as the ones represented by _Chinese Walls_) can be represented by excluding certain label combinations; e.g., if no entity is supposed to know both data of category \(x\) and category \(y\), then labels containing both \(x\) and \(y\) are forbidden (again, this is consistent with [PERSON] [8]). Studies [20,21] have shown that these definitions can be used not only for lattice networks but also for any networks that can be specified by means of access control matrices or permission lists, including the widely implemented role-based access control (RBAC).