Security policies for downgrading

A long-standing problem in information security is how to specify and enforce expressive security policies that control information flow while also permitting information release (i.e., declassification) where appropriate. This paper presents security policies for downgrading and a security type system that incorporates them, allowing secure downgrading of information through an explicit declassification operation. Examples are given showing that the downgrading policy language captures useful aspects of designer intent. These policies are connected to a semantic security condition that generalizes noninterference, and the type system is shown to enforce this security condition. Categories and Subject Descriptors: K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms: Security, Languages

• Type: Conference
• Year: 2004
• Where: CCS
• Authors: Stephen Chong, Andrew C. Myers
• Keywords: CCS 2004, Expressive Security Policies, Security, Security Policies, Security Privacy