We demonstrate, by a number of examples, that information flow security properties can be proved from abstract architectural descriptions, which describe only the causal structure of a system and local properties of trusted components. We specify these architectural descriptions of systems by generalizing intransitive noninterference policies to admit the ability to filter information passed between communicating domains. A notion of refinement of such system architectures is developed that supports top-down development of architectural specifications and proofs by abstraction of information security properties. We also show that, in a concrete setting where the causal structure is enforced by access control, a static check of the access control setting plus local verification of the trusted components is sufficient to prove that a generalized intransitive noninterference policy is satisfied. Additional Key Words and Phrases: Information flow security, epistemic logic, system architecture, intransitive noninterference Stephen Chong and Ron van der Meyden. 2015. Using architecture to reason about information security. et al. [2008], it encompasses a two-level design process, consisting of a policy level and a resource sharing level. At the policy level, the system is described by an architecture in the form of a graph, in which vertices correspond to components and the edges specify permitted communication between components. In this respect, the architecture is like an intransitive noninterference security policy [Haigh and Young 1987; Rushby 1992; van der Meyden 2007] . At the policy level, one might also specify which components are trusted and the local policies that these components are trusted to enforce. According to the MILS vision, building a system according to the architecture, by composing components that satisfy their local policies, should result in the system satisfying global security and safety properties. At the resource sharing level, MILS envisages the use of a range of infrastructural mechanisms to ensure that the architectural information flow policy is enforced despite components sharing resources such as processors, file systems, and network links. These mechanisms might include physical isolation, separation kernels, periods processing, cryptography, and separating network infrastructure. It is intended that this infrastructure will be developed to a high level of assurance so that a systems assurance case can be obtained by the composition of the assurance cases for trusted components and systems infrastructure. It is hoped this will enable a COTS-like market for infrastructural mechanisms and trusted components. The key contribution of this article is to demonstrate, through several examples, that it is in fact possible, as envisaged in the MILS literature, to derive interesting information security properties compositionally from a high-level specification of trusted components and their architectural structure. We focus on compositional reasoning about information flow security properties. We present a framework that allows the specification of a system architecture with local constraints on some system components. To give a precise meaning to the architectural structure, we extend the semantics for intransitive noninterference policies developed by van der Meyden [2007]. These policies are in the form of a graph, in which the vertices correspond to system components, and an edge from component u to component v specifies that information is permitted to flow from u directly to v. This semantics is expressed in an asynchronous model of computation and captures a notion of information available to an attacker that does not have access to timing information. An architectural interpretation of this semantics has previously been given [van der Meyden 2012]. To express constraints on trusted components, we extend architectures by labeling edges between components with functions that further restrict the information permitted to flow along edges. One of the contributions of the work is to give a formal semantics to the enriched architectures that include these new types of edges. We also develop a theory of refinement for these enriched architectures, which enables top-down, correctness-preserving development of architectural specifications. It also enables simple proofs of information security properties on complex architectures to be obtained using an abstraction of that architecture. We demonstrate the use of the framework through examples motivated by systems with interesting security requirements. These include multilevel secure databases, the Starlight Interactive Link [Anderson et al. 1996 ], a trusted downgrader, and a simple electronic election system. In each example, there is an application-specific information flow security property, expressed in a logic of knowledge, to be enforced. To enforce these properties, we identify, in each example, an architectural structure and a mathematically precise set of local constraints on the trusted components. We show for each example that its specific security property arises as a consequence of the interaction of the local constraints and the architectural structure. In each example, our results show that for any system that is compliant with the architecture, if the
Chong and van der Meyden REF extend this framework to filter functions in order to limit the information transmitted about the history.
Using Architecture to Reason about Information Security
TSEC
Computer Science