A Semantic Hierarchy for Erasure Policies

TL;DR

This paper introduces a semantic hierarchy for logical data erasure policies, providing a formal framework to specify and analyze what information can be retained or erased, considering attacker capabilities and retention conditions.

Contribution

It develops a possibilistic knowledge-based semantics for erasure policies, enabling expressive and precise specification of information retention constraints.

Findings

Defines a semantic hierarchy for erasure policies

Allows expressing complex information-flow policies

Provides an upper bound on retained information

Abstract

We consider the problem of logical data erasure, contrasting with physical erasure in the same way that end-to-end information flow control contrasts with access control. We present a semantic hierarchy for erasure policies, using a possibilistic knowledge-based semantics to define policy satisfaction such that there is an intuitively clear upper bound on what information an erasure policy permits to be retained. Our hierarchy allows a rich class of erasure policies to be expressed, taking account of the power of the attacker, how much information may be retained, and under what conditions it may be retained. While our main aim is to specify erasure policies, the semantic framework allows quite general information-flow policies to be formulated for a variety of semantic notions of secrecy.