Polymorphic Relaxed Noninterference

TL;DR

This paper extends relaxed noninterference security typing to support polymorphic declassification in object-oriented systems, enabling more flexible and expressive confidentiality policies while maintaining formal security guarantees.

Contribution

It introduces a formal framework for polymorphic relaxed noninterference, including a step-indexed logical relation proof of security, and addresses practical issues with primitive types.

Findings

Formalization of polymorphic relaxed noninterference in a typed calculus

Proof that all well-typed terms are secure under the new system

Addressing practical challenges with primitive types in declassification

Abstract

Information-flow security typing statically preserves confidentiality by enforcing noninterference. To address the practical need of selective and flexible declassification of confidential information, several approaches have developed a notion of relaxed noninterference, where security labels are either functions or types. The labels-as-types approach to relaxed noninterference supports expressive declassification policies, including recursive ones, via a simple subtyping-based ordering, and provides a local, modular reasoning principle. In this work, we extend this expressive declassification approach in order to support polymorphic declassification. First, we identify the need for bounded polymorphism through concrete examples. We then formalize polymorphic relaxed noninterference in a typed object-oriented calculus, using a step-indexed logical relation to prove that all well-typed terms are secure. Finally, we address the case of primitive types, which requires a form of ad-hoc polymorphism. Therefore, this work addresses practical hurdles to providing controlled and expressive declassification for the construction of information-flow secure systems.