Previously, we developed a type system to ensure secure information flow in a sequential, imperative programming language [vSI96]. Program variables are class%ed as either high or low security; intuitively, we wish to prevent information from Bowing from high variables to low variables. Here, we extend the analysis to deal with a multithreaded language. We show that the previous type system is insufficient to ensure a desirable security property called noninterference. Noninterference basically means that the final values of low variables are independent of the initial values of high variables. By modifymg the sequential type system, we are able to guarantee noninterference for concurrent programs. Crucial to this result, however, is the use of purely nondeterministic thread scheduling. Since implementing such scheduling is problematic, we also show how a more restrictive type system can guarantee noninterference, given a more deterministic (and easily implementable) scheduling policy, such as round-robin time slicing. Finally, we consider the consequences of adding a clock to the language.
Secure information flow in a language with the possibility to spawn new threads was first considered in REF .
Secure information flow in a multi-threaded imperative language
POPL '98
Computer Science