# An Approach to Analyze Vulnerability of Information Flow in Software Architecture
## 2 Related Work
### Information Flow Control  
Information flow is the information propagation and flow inside a system and across systems [48]. Information flow control is a significant means in cyber security area to ensure end-to-end information security. Information flow control employs security policies or security models to control the flow of information [49]. In this paper, we will use the thinking of information flow control to analyze the information flow vulnerabilities in software architecture.  
First of all, we will clarify the concepts and terms used in information flow security, including security goals, security policies, security models, and lattice model of information flow.  
Security goals of information flow include confidentiality goals and integrity goals. Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities,or processes. Integrity is the property that information cannot be modified in an unauthorized or undetected manner, and the accuracy and completeness of information is maintained and assured over its entire lifecycle.  
Security policies of information flow are a set of policies designed for a group of security goals, which define what is allowed and what is prohibited. Similar to security goals, security policies include confidentiality policies and integrity policies. Confidentiality policies prevent information from flowing to entities that are not authorized to access the information. Integrity policies prevent information from flowing to entities with higher integrity [50].  
Security policies are usually represented by security models. Security models are representations of security policies by use of formal or mathematical terminology. [PERSON] made a detailed summary of security models in [51]. In this paper, we will make use of two important information flow security models, which are Bell-LaPadula model and Biba model. The Bell-LaPadula model is suitable for military security policies. It ensures system confidentiality by preventing the diffusion of unauthorized information [52]. The basic principle of the Bell-LaPadula model is that a subject with a higher security level is not allowed to write an object with a lower security level, and a subject with a lower security level is not allowed to read an object with a higher security level, which can be characterized as \"no read up, no write down.\" The Biba model [53] is used to protect integrity. Its basic principle is that a subject with a higher integrity level can write an object with a lower integrity level, and a subject with a lower integrity level can read an object with a higher integrity level, which can be characterized as \"no write up, no read down\".  
In various formal or mathematical descriptions of information flow security models, the most widely used model is the lattice model of information flow proposed by [PERSON]. The information lattice model is defined as follows [48]:  
If (L,\(\leq\)) is a semi-order set and there is a maximum lower bound and a minimum upper bound for every element (a,b) in L, then the tuple (L,\(\leq\)) is lattice.  
This model is used for classifying information into different security groups. Each group of information forms a security class. Information is only allowed to flow between specified security classes. According to confidentiality policies, information is only allowed to flow inside a security class (class A) or into a security class (class B) with a higher security level. According to integrity policies, information is only allowed to flow inside a security class or into a security class with a lower security level.  
In later sections, we will use the lattice model to depict the information flow security in software architecture.